NIST SP 800-170 日本語訳

Assets

Mobile Devices

Continuous Monitoring

2013 Annual Report

NIST Special Publication 800-170

Continuous Monitoring

NIST Special Publication 800-170

Patrick O’Reilly, Editor

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology

Co-Editors: Chris Johnson Doug Rike Greg Witte

G2, Inc.

Lorie Richards

Facilities Services Division Creative and Printing Service

This publication is available free of charge from

http://dx.doi.org/10.6028/NIST.SP.800-170

U.S. Department of Commerce

National Institute of Standards and Technology

Dr. Willie E. May, Under Secretary of Commerce for Standards and Technology and Acting Director

Disclaimer: Any mention of commercial products is for information only; it does not imply NIST recommendation or endorsement, nor does it imply that the products mentioned are necessarily the best available for the purpose.

National Institute of Standards and Technology Special Publication 800-170 Natl. Inst. Stand. Technol. Spec. Pub., 93 pages (June 2014) CODEN: NSPUE2

The Computer Security Division (CSD), a component of the Information Technology Laboratory at the National Institute of Standards and Technology (NIST) is responsible for developing standards, guidelines, tests, and metrics for protection of non-national security federal information systems. NIST standards and guidelines are developed in an open and transparent manner that enlists broad industry and academia expertise from around the world. While developed for federal agency use, these resources are voluntarily adopted by other organizations because they are effective and accepted throughout the world.

The need for cybersecurity standards and best practices that address interoperability, usability and privacy continues to be critical for the Nation. In Fiscal Year (FY) 2013, CSD continued to align its resources to enable greater development and application of practical, innovative security technologies and methodologies that enhance our ability to address current and future computer and information security challenges. Our foundational research and applied cybersecurity programs continue to advance in many areas including cryptography; identity and access management; cloud, virtualization, and mobile technologies; and advanced security testing and measurement.

Strong partnerships with diverse stakeholders are vital to the success of our technical programs. In February 2013, the President issued Executive Order 13636 that directed NIST to work collaboratively with industry to develop a voluntary framework - based on existing standards, guidelines, and practices - to improve critical infrastructure cybersecurity practices. NIST held several workshops, meetings, webinars, and informal sessions to gather feedback with the goals of generating content for the framework and discuss several topics that help inform and guide NIST in this effort. In August 2013, we produced a discussion draft of the preliminary framework.

Working closely with standards developing organizations, industry and interagency partners, we are evolving and expanding security automation capabilities to help organizations manage and measure the security of systems and technologies. Our cybersecurity awareness, training, and education programs also exemplify the importance of these partnerships by engaging with academic institutions, federal agencies, small and medium businesses and others to increase awareness and enhance the overall cybersecurity posture of the Nation.

Active engagement with the diverse federal community continues to be critical to our success. This interaction is most prominent in our strengthened collaborations with the Department of Defense, the Intelligence Community, and the Committee on National Security Systems to establish a common foundation for information security across the federal government. Through this partnership, NIST released Special Publication (SP) 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, in April 2013. This guideline provides organizations with state-of-the-practice security controls to fundamentally strengthen their systems and the environments in which those systems operate. SP 800-53 Revision 4 and other NIST standards and guidelines contribute to systems that are more resilient in the face of cyber attacks and other threats.

Late in FY 2013, news reports about leaked classified documents caused concern from the cryptographic community about the security of NIST cryptographic standards and guidelines. Recognizing community concern regarding some specific standards, we reopened the public comment period for three Special Publications to give the public a second opportunity to view and comment on the documents. This initial step will be followed by a review of our cryptographic development process and NIST cryptographic standards and guidelines in FY 2014.

For many years, CSD, in collaboration with our global partners across industry, academia, and government, has made great contributions to help secure the nation’s critical information and infrastructure. We look forward to furthering these relationships in FY 2014 as we lead the development and practical implementation of scalable and sustainable information security standards and practices in areas such as cyber-physical and industrial control systems, privacy engineering, security automation, and mobile technologies.

To participate in any CSD research areas – whether current or future – or to learn more about our programs and activities, please visit http://csrc.nist.gov.

Chief, Computer Security Division & Deputy Chief Cybersecurity Advisor

Donna Dodson, Chief, Computer Security Division, Acting Associate Director & Acting Chief Cybersecurity Advisor, Cybersecurity Advisor Office, and Acting Executive Director, National Cybersecurity Center of Excellence

Matthew Scholl, Deputy Chief, Computer Security Division and Acting Associate Director of Operations, National Cybersecurity Center of Excellence

Lily Chen, (Acting Group Manager) Cryptographic Technology Group

Kevin Stine, Security Outreach and Integration Group

Mark (Lee) Badger, Security Components and Mechanisms Group

David Ferraiolo, Secure Systems and Applications Group

Michael Cooper, Security Testing, Validation and Measurement Group

The Computer Security Division’s computer scientists, mathematicians, IT specialists, administrative staff and others support CSD’s mission and responsibilities through five groups that are described in the following sections:

Research, develop, engineer, and standardize cryptographic algorithms, methods, and protocols.

CTG’s work in the field of cryptography includes researching, analyzing, and standardizing cryptographic technology, such as hash algorithms, symmetric and asymmetric cryptographic techniques, key management, authentication, and random number generation. CTG’s goal is to identify and promote methods to enhance trust in communications, data, and storage through cryptographic technology, encouraging innovative development and helping technology users to manage risk.

In Fiscal Year (FY) 2013, CTG continued to make an impact in the field of cryptography, both within and outside the Federal Government, by collaborating with national and international agencies, academic and research organizations, and standards bodies to develop interoperable security standards and guidelines. In addition, CTG worked with industry partners to promote the use of NIST-approved cryptographic methods.

Federal agency collaborators include the National Security Agency (NSA), the Intelligence Advanced Research Projects Activity (IARPA), the National Telecommunications and Information Administration (NTIA), the National Strategy for Trusted Identities in Cyberspace (NSTIC), General Services Administration (GSA), the United States Postal Service (USPS), and the Election Assistance Commission (EAC).

CTG also works closely with foreign government agencies, such as the Communications Security Establishment of Canada and Australia’s Defense Signals Agency and Centrelink. Additionally, CTG is active in national and international standards bodies, including the Accredited Standards Committee (ASC) X9 (financial industry standards), the International Organization for Standardization (ISO), the Institute of Electrical and Electronics Engineers (IEEE), the Internet Engineering Task Force (IETF), the American National Standards Institute (ANSI), and the Trusted Computing Group (TCG). Industry collaborators include Intel, Microsoft, and Cisco.

Academic collaborators include Carnegie Mellon University, Yale University, University of Southern Denmark, the University of Milan, Malaga University, and the University of Lisbon. Research organizations include the Information-technology Promotion Agency (IPA)/Cryptography Research and Evaluation Committees (CRYPTREC) and the Ministry of Economy, Trade and Industry (METI) of Japan.

Dr. Lily Chen, (301) 975-6974, lily.chen@nist.gov

Research, develop, and standardize foundational security mechanisms, protocols, and services.

The SCMG’s security research focuses on the development and management of foundational building-block security mechanisms and techniques that can be integrated into a wide variety of mission-critical U.S. information systems. The group’s work spans the spectrum from near-term hardening and improvement to the design and analysis of next-generation, leap-ahead security capabilities. Computer security depends fundamentally on the level of trust for computer software and systems. This work, therefore, focuses strongly on assurance building activities ranging from the analysis of software configuration settings to advanced trust architectures to testing tools that surface flaws in software modules. This work also focuses significantly on increasing the applicability and effectiveness of automated techniques, wherever feasible. The SCMG conducts collaborative research with government, industry, and academia. Outputs of this research consist of prototype systems, software tools, demonstrations, NIST Special Publications (SP), NIST Interagency or Internal Reports (NISTIR), and conference and journal papers.

SCMG works on a variety of topics, such as specifications for the automated exchange of security information between systems, computer security incident handling guidelines, formulation of high-assurance software configuration settings, hardware roots of trust for mobile devices, secure Basic Input Output System (BIOS) layers, combinatorial testing techniques, conformity assessment of software implementing biometric standards, and adoption of Internet Protocol Version 6 and Internet Protocol security extensions. SCMG collaborates extensively with government, academia, and the private sector.

In FY 2013, collaborations have included Carnegie Mellon University (test development environment), Johns Hopkins Applied Physics Lab (practical application of combinatorial coverage measurement tool), North Carolina State University (access control policy testing), University of North Texas and University of Maryland-Baltimore County (test prioritization algorithms), University of Texas at Arlington (covering array generation algorithm), Mexico’s Centro Nacional de Metrología (constraints for testing coverage tool), National Aeronautics and Space Administration (NASA) (practical application for combinatorial coverage measurement), U.S. Air Force Test and Evaluation (a new event sequence testing method), the National Security Agency (secure software tool chain competition development), and the Department of Homeland Security (incident coordination).

SCMG accomplishments include the Advanced Combinatorial Testing System (ACTS) software and documentation, the NIST BioCTS 2013 biometric conformance testing tool and test assertions, and a security log analysis tool.

Mr. Mark (Lee) Badger, (301) 975-3176, mark.badger@nist.gov

Integrate and apply security technologies, standards, and guidelines for computing platforms and information systems.

SSAG’s security research focuses on the identification of emerging and high-priority technologies and on the development of security solutions that will enhance the security of U.S. critical information infrastructure. The group conducts research and development on behalf of government and industry from the earliest stages of technology development through proof-of-concept, reference and prototype implementations, and demonstrations. SSAG works to transfer new technologies to industry; to produce new standards and guidance for federal agencies and industry; and to develop tests, test methodologies, and assurance methods.

SSAG investigates topics such as mobile device security, cloud computing and virtualization, identity management, access control and authorization management, and software assurance. SSAG research helps federal agencies meet information security requirements that might not be fully addressed by existing technology. The group collaborates extensively with government, academia, and private sector entities.

Example successes from this work include tools for access control policy testing, new concepts in access control and policy enforcement, methods for achieving comprehensive policy enforcement and data interoperability across enterprise data services, and test methods for mobile device (smart phone) application security. For example, the SSAG Mobile Application Testing Portal (ATP) went operational for military use (known in the U.S. Army as PANTHR) and is in the process of transitioning to other federal agencies as open source. In support of the Federal Government’s cloud computing initiatives, SSAG led the NIST Security Working Group that published the NIST Cloud Computing - Security Reference Architecture. The SSAG also completed revision of Federal Information Processing Standard (FIPS) 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, which was approved by the Secretary of Commerce and published in September of 2013.

To improve access to new technologies, SSAG chaired, edited, and participated in the development of a wide variety of national and international security standards.

Mr. David Ferraiolo, (301) 975-3046, david.ferraiolo@nist.gov

Develop, integrate, and promote the mission-specific application of information security standards, guidelines, best practices, and technologies.

The U.S. economy, citizens, and government rely on information technology (IT); so the protection of IT and information infrastructure is critical. SOIG leverages broad cybersecurity and risk management expertise to develop, integrate, and promote security standards, guidelines, tools, technologies, methodologies, tests, and measurements to address cybersecurity needs in many areas of national and international importance.

The SOIG collaborates with stakeholders to address cybersecurity considerations in many diverse program areas, including the Information and Communications Technologies (ICT) supply chain, Smart Grid, Electronic Voting, Health Information Technology, and Cyber Physical and Industrial Control Systems. The group continues to increase its efforts to research, develop, and align cybersecurity standards, practices, and testing methods necessary to foster interoperable and secure public safety communications. In our Federal Information Security Management Act (FISMA) implementation program, the group produces standards and guidelines to help federal agencies build strong cybersecurity risk management programs. In each of these program areas, the group extends outreach to stakeholders across federal, state, and local governments; industry; academia; small businesses; and the public. The SOIG also leads several broad cybersecurity awareness, training, education, and outreach efforts, including the National Initiative for Cybersecurity Education (NICE), the Small- and Medium-sized Business (SMB) outreach program, the Federal Computer Security Managers’ Forum, and the Federal Information Systems Security Educators’ Association (FISSEA).

Key to the group’s success is the ability to interact with a broad constituency to ensure that SOIG’s program is consistent with national objectives related to or impacted by information security. Through open and transparent public engagement, collaboration, and cooperation, the group works to address critical cybersecurity challenges, enable greater U.S. industrial competitiveness, and facilitate practical implementation of scalable and sustainable information security standards and practices.

Mr. Kevin Stine, (301) 975-4483, kevin.stine@nist.gov

Advance information security testing, measurement science, and conformance.

Federal agencies, industry, and the public rely on cryptography for the protection of information and communications used in electronic commerce, critical infrastructure, and other application areas. The STVMG supports testing and validation of underlying cryptographic modules and cryptographic algorithms in consideration of established standards. These cryptographic modules and algorithms enable products and systems to provide security services, such as confidentiality, integrity, and authentication. Although cryptography provides security, poor designs or weak algorithms can render a product insecure and place highly sensitive information at risk. When protecting sensitive data, Federal Government agencies require a minimum level of assurance that cryptographic products meet established security requirements and use only tested and validated cryptographic modules.

STVMG’s testing-focused activities include validating cryptographic algorithm implementations, cryptographic modules, and Security Content Automation Protocol (SCAP)-compliant products; developing test suites and test methods; providing implementation guidance and technical support to industry forums; and conducting education, training, and outreach programs.

STVMG’s validation programs work together with independent Cryptographic and Security Testing laboratories that are accredited by the NIST National Voluntary Laboratory Accreditation Program (NVLAP). Based on the independent laboratory test report and test evidence, the Validation Program then validates the implementation under test. NIST publishes, through public websites, lists of validations awarded.

Mr. Michael Cooper, (301) 975-8077, michael.cooper@nist.gov

The E-Government Act, Public Law 107-347, passed by the 107th Congress and signed into law by the President in December 2002, recognized the importance of information security to the economic and national security interests of the United States. Title III of the E-Government Act, entitled the Federal Information Security Management Act (FISMA) of 2002, included duties and responsibilities for the National Institute of Standards and Technology, Information Technology Laboratory, Computer Security Division (CSD). In 2013, CSD addressed its assignments through the following activities:

Validated Products List

Mobile Devices

Continuous Monitoring

In FY 2013, CSD continued to research and develop guidance for a broad array of technical areas, including supply chain risk management; security analytics; cloud, mobile, and privacy-enhancing technologies; hardware-enabled security; and cyber-physical and embedded systems. The staff and guest researchers within CSD have collaborated with global partners from government, industry, and academia, making significant contributions to help secure critical information and infrastructure. The following sections describe CSD’s programs and project achievements that include extensive research and development for high-quality, cost-effective security and privacy mechanisms, standards, guidelines, tests, and metrics that address current and future computer and information security challenges.

Recognizing that the national and economic security of the United States depends on the reliable functioning of critical infrastructure, the President issued Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity, in February 2013. This Executive Order directed NIST to work with stakeholders to develop a voluntary framework – based on existing standards, guidelines, and practices − for reducing cybersecurity risks to critical infrastructure.

The Cybersecurity Framework will provide a prioritized, flexible, repeatable, performance-based, and cost-effective approach, including information security measures and controls to help owners and operators of critical infrastructure and other interested entities to identify, assess, and manage cybersecurity-related risk while protecting business confidentiality, individual privacy, and civil liberties. To enable technical innovation and account for organizational differences, the Cybersecurity Framework will not prescribe particular technological solutions or specifications.

In FY 2013, NIST worked with a diverse stakeholder community to develop the Framework through an open public process. This process included:

In FY 2014, NIST will continue to conduct stakeholder outreach and will work collaboratively to further develop and issue the Cybersecurity Framework. NIST will initiate a 45-day public comment period on the Preliminary Cybersecurity Framework, review and adjudicate all public comments received, and issue a final Cybersecurity Framework (version 1.0) in February 2014 as specified in the Executive Order.

http://www.nist.gov/cyberframework

Mr. Kevin Stine (301) 975-4483 kevin.stine@nist.gov

Mr. Adam Sedgewick (301) 367-4678 adam.sedgewick@nist.gov

Figure 1 (below) shows many of the national and international Standards Developing Organizations (SDOs) involved in cybersecurity standardization. CSD participates in cybersecurity standards activities in many of these organizations, either in leadership positions or as editors and contributors. Many of CSD’s publications have been the basis for both national and international standards projects. This section discusses CSD standards activities in conjunction with InterNational Committee for Information Technology Standards (INCITS) Technical Committee Cyber Security 1 (CS1), where Dan Benigni serves as Chair and U.S. Head of Delegation to subcommittee SC 27, and Sal Francomacaro serves as CS1 Vice Chair.

The International Organization for Standardization (ISO) is a network of the national standards institutes of 148 countries, with the representation of one member per country. The scope of ISO covers standardization in all fields except electrical and electronic engineering standards, which are the responsibility of the International Electrotechnical Commission (IEC).

The IEC prepares and publishes international standards for all electrical, electronic, and related technologies, including electronics, magnetics and electromagnetics, electroacoustics, multimedia, telecommunication, and energy production and distribution, as well as associated general disciplines such as terminology and symbols, electromagnetic compatibility, measurement and performance, dependability, design and development, safety, and the environment.

Figure 1: Cybersecurity Standards Development Organizations (SDOs)

Joint Technical Committee 1 (JTC 1) was formed by ISO and IEC to be responsible for international standardization in the field of information technology. It develops, maintains, promotes, and facilitates IT standards required by global markets, meeting business and user requirements concerning:

JTC 1 consists of a number of subcommittees (SCs) and working groups that address specific technologies. SCs that produce standards relating to IT security include:

JTC 1 also has:

ANSI is a private, nonprofit organization (501(c)(3)) that administers and coordinates the U.S. voluntary standardization and conformity assessment system and facilitates the development of American National Standards (ANS) by accrediting the procedures of SDOs.

ANSI promotes the use of U.S. standards internationally, advocates U.S. policy and technical positions in international and regional standards organizations, and encourages the adoption of international standards as national standards where they meet the needs of the user community. ANSI is the sole U.S. representative and dues-paying member of the two major non-treaty international standards organizations, ISO and, via the United States National Committee (USNC), the IEC.

INCITS is accredited by ANSI and serves as the ANSI Technical Advisory Group (TAG) for ISO/IEC Joint Technical Committee 1. INCITS is sponsored by the Information Technology Industry (ITI) Council, a trade association representing the leading U.S. providers of information technology products and services.

INCITS is organized into Technical Committees that focus on the creation of standards for different technology areas. Technical committees that focus on IT security and IT security-related technologies or that may require separate security standards include:

As a technical committee of INCITS, CS1 develops United States, national, ANSI-accredited standards in the area of cybersecurity. Its scope encompasses:

The scope of CS1 explicitly excludes the areas of work on cybersecurity standardization presently under way in INCITS B10, M1, T3, T10, and T11, as well as other standard groups, such as the Alliance for Telecommunications Industry Solutions (ATIS), the Institute of Electrical and Electronics Engineers, Inc. (IEEE), the Internet Engineering Task Force (IETF), the Travel Industry Association of America (TIAA), and the Accredited Standards Committee (ASC) X9. The CS1 scope of work includes standardization in most of the same cybersecurity areas as are covered in the NIST CSD.

As the U.S. TAG to ISO/IEC JTC 1/SC 27, CS1 contributes to the SC 27 program of work on IT Security Techniques in terms of U.S. comments and contributions on SC 27 standards projects; votes on SC 27 standards documents at various stages of development; and nominates U.S. experts to work on various SC 27 projects as editors, coeditors, or in other SC 27 leadership positions. Currently, over a dozen CS1 members are serving as SC 27 document editors or coeditors on various standards projects, including CSD staff Randy Easter and Richard Kissel.

All input from CS1 is processed through INCITS to ANSI, then to SC 27. CS1 also serves as a conduit for getting U.S.-based new work item proposals and U.S.-developed national standards into the international SC 27 standards development process. In its international efforts, CS1 responded to all calls for U.S. contributions and/or voting positions on all international security standards projects in ISO/IEC JTC1 SC 27 in a consistent, efficient, and timely manner.

NIST contributes to many of CS1’s national and international IT security standards efforts through its membership on CS1, where Dan Benigni serves as the non-voting chair and Richard Kissel as the NIST Principal voting member. Internationally, there are over 100 published standards, and almost all have been adopted as U.S. national standards. There are more than 80 current international standards projects. During FY 2013, 29 new standards were published in SC 27, and most of them have been recommended by CS1 for adoption as U.S. national standards.

CSD’s cybersecurity research also plays a direct role in the Cybersecurity Standardization efforts of CS1 at the national level. Nationally during FY 2013:

Within CS1, liaisons are maintained with nearly 20 organizations, including:

Dan Benigni also serves as cybersecurity standards coordinator in CSD.

Mr. Daniel Benigni (301) 975-3279 benigni@nist.gov

CSD supports identity management standardization activities through participation in national and international standards bodies and organizations. CSD actively participates in the INCITS B10 committee, which is focused on interoperability of Identification Cards and Related Devices. CSD staff serves as Chair and Vice Chair of the B10.12 committee, which develops interoperable standards for Integrated Circuit Cards with Contacts. CSD staff also serves as the U.S. Head of delegation to ISO/IEC JTC1 SC 17 Working Groups 4 and 11.

In addition to chairing the B10.12 committee, CSD provides technical and editorial support in the development of national and international standards. Specifically, CSD staff serves as the technical editor of ANSI 504-1, Generic Identity Command Set (GICS). GICS enables PIV, PIV-Interoperable (PIV-I) and Common Access Card (CAC) card applications, and others, to be built from a single platform. GICS defines an open platform where identity applications can be instantiated, deployed, and used in an interoperable way between the credential issuers and credential users. CSD staff also provides significant input to standards of major interest to U.S. government agencies and U.S. markets. CSD influences the development and revision of ISO/IEC 7816 (Identification Cards, Integrated Circuit Cards), ISO/IEC 24727 (Identification Cards, Integrated Circuit Card Programming Interfaces), and ISO/IEC 24787 (Biometrics “Match On Card” Comparison).

During FY 2013, INCITS 504 Parts 1, 2, and 4 were published and ISO/IEC 7816 Part 4 was published with significant changes added per NIST’s request. CSD provides contributions and feedback on many other INCITS B10 identity management standards projects.

During the FY 2014, the INCITS B10 committee, along with the active collaboration of CSD staff, plans to publish Part 3 of INCITS 504 and contribute to the publication of several standards of the ISO/IEC 7816 family (all relevant to FIPS 201 specifications). CSD staff will continue actively supporting relevant ID management standard initiatives.

CSD’s investment in these activities is motivated by new technical ideas that emerge from these standards. For example, INCITS 504 is an ID platform that leverages the FIPS 201 infrastructure to support a larger number of government and enterprise initiatives. In particular, INCITS 504 aims to support initiatives such as the NSTIC. ISO/IEC 24727 aims to create an interoperability framework that increases the resilience and scalability of identity management solutions and fosters domestic and international interoperability.

Mr. Salvatore Francomacaro (301) 975-6414 salvatore.francomacaro@nist.gov

The FISMA Implementation Project focuses on:

During 2013, CSD strengthened its collaboration with the Department of Defense (DoD), the Intelligence Community, and the Committee on National Security Systems (CNSS), in partnership with the Joint Task Force Transformation Initiative, which continues to develop key cybersecurity guidelines for protecting federal information and information systems for the Unified Information Security Framework. Previously, the Joint Task Force developed common security guidance in the critical areas of security controls for information systems and organizations, security assessment procedures to demonstrate security control effectiveness, security authorizations for risk acceptance decisions, and continuous monitoring activities to ensure that decision makers receive the most up-to-date information on the security state of their information systems. In addition, CSD worked with the General Services Administration (GSA) Federal Risk and Authorization Management Program (FedRAMP) to identify security assessment requirements, and prototype a process for approving Third-Party Assessment Organizations (3PAOs) that demonstrate capability in assessing Cloud Service Providers (CSP) information systems for conformance to NIST standards and guidelines.

In FY 2013, CSD worked on the following three initiatives:

Developed a comprehensive risk assessment guideline examining the relationships among key risk factors, including threats, vulnerabilities, impact, and likelihood. Special Publication (SP) 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, provides a holistic approach to information security and risk management. The publication provides organizations with security controls necessary to appropriately strengthen their information systems and the environments in which those systems operate − contributing to systems that are resilient in the face of attacks and other threats. This “Build It Right” strategy combines with a variety of security controls for “Continuous Monitoring” to give organizations near real-time information that is essential for senior leaders making ongoing risk-based decisions affecting their critical missions and business functions.

To take advantage of the expanded set of security and privacy controls, and to give organizations greater flexibility and agility in defending their information systems, the revision introduces the concept of overlays. Overlays provide a structured approach to help organizations tailor security control baselines and develop specialized security plans for specific missions/business functions, environments of operation, and/or technologies. This specialization approach is important as the number of threat-driven controls and control enhancements in the catalog increases and organizations develop risk management strategies to address their specific protection needs within defined risk tolerances.

Figure 2: Generic Risk Model with Key Risk Factors

CSD updated proficiency tests and technical requirements for evaluating FedRAMP 3PAO providers’ capability to conduct security assessment of cloud-based information systems for compliance with FISMA in accordance with FedRAMP and ISO/IEC 17020 Inspection Bodies requirements. Additionally, CSD provided input to GSA requirements (including orientation and training) for private sector accreditation body of FedRAMP 3PAOs that resulted in GSA FedRAMP Program Management Office (PMO) selecting one 3PAO private sector accreditation body.

CSD conducted cybersecurity outreach briefings and provided support to state and local governments as well as private sector organizations on topics of interest, such as effective implementation of the NIST Risk Management Framework. In addition, CSD conducted outreach activities with academic institutions, providing information on NIST’s security standards and guidelines, and exploring new areas of cybersecurity research and development.

In FY 2013, CSD completed the following outreach activities:

In FY 2014, CSD intends to:

http://csrc.nist.gov/sec-cert

Dr. Ron Ross, (301) 975-5390, ron.ross@nist.gov

Mr. Arnold Johnson, (301) 975-3247, arnold.johnson@nist.gov

Ms. Peggy Himes, (301) 975-2489, peggy.himes@nist.gov

Ms. Pat Toth, (301) 975-5140, patricia.toth@nist.gov

Ms. Kelley Dempsey, (301) 975-2827, kelley.dempsey@nist.gov

The CSD staff responds to government, industry, and market requirements for open systems standards by:

To achieve these project goals, CSD continues to work in close partnership with government agencies, industry partners, and academic institutions. CSD actively participates in a number of biometric standards development projects, contributes to the development of biometric standards, and leads national and international biometric standards bodies. Nationally, CSD’s staff leads the INCITS Technical Committee 1 (M1) – Biometrics; international efforts include ISO JTC 1 and IEC Subcommittee SC 37 - Biometrics - JTC 1/SC 37. CSD plans to continue this work in FY 2014.

During FY 2013, the development of object-oriented CTAs and CTSs to test implementations of biometric standards progressed at an accelerated pace. CSD developed and publicly released two fully functional object-oriented CTAs. One CTA supports CTSs designed to test implementations of Extensible Markup Language (XML) encoded biometric data interchange formats and the other supports CTSs designed to test implementations of ISO/IEC data formats developed by JTC 1/SC 37 as well as PIV profiles of biometric standards. CSD released these test tools as “BioCTS 2013 for ANSI/NIST 1-2011” and “BioCTS 2013 for ISO/IEC” respectively. As depicted in the figure, CTA/CTSs’ key features include search capabilities of the Text Log Outputs (very useful to debug errors in large implementations), formatted test results, and test result basic statistics (on batch of files or individual files).

In addition to previously designed CTSs (e.g., CTS for ANSI/NIST-ITL 1-2011 [AN-2011] traditional encoding transactions and ISO/IEC biometric data interchange format implementations), BioCTS 2013 conformance test software includes a CTS designed to test National Information Exchange Model (NIEM) XML encoded AN-2011 implementations. The functionality of this tool goes beyond the existing basic XML testing techniques, such as schema validation. CSD’s project team concluded that the XML schema validation was insufficient to address full conformance testing of the AN-2011 requirements. The team implemented over 1,200 test assertions beyond the schema validation (validating an XML file against an XSD file) for this standard, including those for AN-2011 Record Types 1, 4, 10, 13, 14, 15, and 17. NISTIR 7957, Conformance Test Architecture and Test Suite for ANSI/NIST-ITL 1-2011 NIEM XML Encoded Transactions (September 2013) and a presentation delivered at the last Biometric Consortium conference discussed these test tools and provided technical implementation details.

BioCTS 2013 conformance test software also includes CTSs to test PIV profiles (e.g., finger minutia and image data formats) and to test implementations of the second-generation face recognition data format developed by JTC 1/SC 37 (published in 2011). The PIV profile of the SC 37 iris data format was aligned with SP 800-76-2, Biometric Specifications for Personal Identity Verification. The face recognition CTS was aligned with the associated conformance testing methodology developed by JTC 1/SC 37.

Figure 3: Biometric Conformance Test Software by NIST/ITL CSD

These conformance-testing tools provide significant functionality, usability, and performance. In addition to supplying an installer version of the CTAs, which supports new and existing CTSs with new graphical user interface enhancements, the CSD project team extended the work to a command line interface version for AN-2011 traditional encoding that runs under Windows and Linux (with Mono). The test tools developed support a Web-based environment. A prototype was developed, tested, and demonstrated at the last Biometric Consortium Conference.

Based on the detailed analysis of the biometric standards (ISO/IEC and AN-2011) required to develop the associated conformance test tools, the CSD team provided technical contributions to the relevant standards bodies. In FY 2013, these included:

In addition to ongoing participation and management of biometric standards activities in INCITS M1 and JTC 1/SC 37, in FY 2014, CSD plans to develop additional CTSs to test implementations of selected international biometric data interchange formats specified in XML encoding (under development in JTC 1/SC 37). The CSD team also plans to develop conformance test assertions for selected record types of the 2013 version of the ANSI/NIST standard and plans to develop the associated CTA/CTS for traditional and XML encoded transactions. The latest version of the ANSI/NIST standard now incorporates extended forensics-related data, such as a dental supplement and additional record types, such as voice data record. The team will continue researching and developing additional test environments support, such as web services and tools in the cloud. The research plan expands to technical interfaces, such as Biometric Application Programming Interface standards specified in Object Oriented Programming and Biometric Information Assurance Services standards.

Outreach efforts in FY 2013 in support of biometric standards development and conformity assessment efforts included:

NIST helped develop the program of the 2013 Biometric Consortium Conference, which CSD’s Mr. Fernando Podio co-chaired. Held September 17-19, 2013, in Tampa, Florida, this year’s conference included nearly 1,600 attendees from 30 countries representing government, industry, and academia.

CSD supported a booth at the conference’s technical exposition and presented material regarding the conformance test tool development project. The conference program included sessions on Federal Government programs, advances in biometric technologies and standards, and Biometrics Identity and Security (BIdS) research. NIST’s session highlighted achievements and ongoing biometric research, testing, and standards projects. Over 140 speakers participated in the program.

ITL’s Biometric Resource Center: http://www.nist.gov/biometrics

BioCTS 2013 - Biometric Conformance Test Tool Downloads: http://www.nist.gov/itl/csd/biometrics/biocta_download.cfm#CTAdownloads

Biometric Consortium website: http://www.biometrics.org

Biometric Consortium 2013 conference program (released presentations are linked): http://www.biometrics.org/bc2013/program.pdf

Mr. Fernando Podio (301) 975-2947 fernando.podio@nist.gov

Leveraging CSD’s expertise in cybersecurity for industrial control systems, smart grid, hardware-enabled security, and embedded systems, the division is now researching cybersecurity needs of the broader landscape of cyber-physical systems (CPS). CPS are hybrid networked cyber and engineered physical elements co-designed to create adaptive and predictive systems that respond in real-time to enhance performance with varying degrees of human interaction, and are commonly used in the nation’s critical infrastructure. Such systems control the electrical grid, provide clean water, produce chemicals, and underlie transportation systems. CPS capabilities continue to grow as a result of technological advances, enabling future engines of growth, such as advanced manufacturing, and advancements in safety initiatives, such as autonomous vehicles.

Cybersecurity is an important crosscutting discipline that is critical to safeguarding CPS and supporting communications and information infrastructure. CPS presents unique challenges, including the need for real-time response in support of extremely high availability, predictability, and reliability. Despite the ubiquity and criticality of CPS, additional thought is required regarding the design of secure CPS. As a result, there have been numerous successful attacks targeting CPS for the control of critical infrastructure (e.g., Stuxnet, Duqu, Flame, Gauss).

In April 2013, CSD and the Cyber Security Research Alliance (CSRA) co-hosted a 2-day workshop to explore emerging research needs for cybersecurity in CPS with the diverse cyber-physical community at large. The workshop brought together engineering and IT experts who have dealt with security issues related to CPS. Representatives from industry, academia, and government engaged in interactive discussions during the workshop in the areas of supply chain, assurance, threat information, identifying existing tools and practices to secure CPS, security in acquisition and implementation, and trustworthy operations. Attendees were invited to participate in break-out sessions where the discussion topics were briefly framed, allowing the attendees to explore the discussion topics and to share their experiences with integrating security into existing organizations (e.g., lessons learned and examples).

CSD, in conjunction with ITL’s Advanced Network Technologies division, Information Access division, and NIST’s Engineering Laboratory, collaborated to develop an initial NIST notional reference architecture for CPS. This notional reference architecture was designed at such a level of abstraction that it can be applied across the breadth of the CPS, yet provides modularization and context for integration. The notional CPS reference architecture was driven from a community need to provide a common lexicon and taxonomy, a common architectural vision to help facilitate interoperability between elements and systems, and promotes communication across the breadth of CPS stakeholders.

CSD, in conjunction with NIST’s Engineering Laboratory, will finalize the revision of SP 800-82 in FY 2014. CSD will continue to participate in the International Society of Automation (ISA) 99 Committee, which develops and establishes standards, recommended practices, technical reports, and related information that define procedures for implementing electronically secure industrial automation and control systems and security practices, and for assessing electronic security performance. Leveraging the initial NIST notional reference architecture as a starting point to address the lack of an industry-wide consensus definition, reference architecture, and taxonomy for CPS, CSD will work in collaboration with NIST’s Engineering Laboratory and ITL’s Software and Systems division, and Advanced Networking Technologies division to lead a public-private working group of government, academia, and industry stakeholders. The working group will consist of 5 technical subgroups: 1) Definitions and Taxonomy, 2) Reference Architecture, 3) Use Cases, 4) Cybersecurity and Privacy, and 5) Timing. CSD will lead the Cybersecurity and Privacy subgroup focused on identifying strategies for cybersecurity and privacy in CPS, and work collaboratively with the other subgroups to ensure that cybersecurity is included as a design principle in development.

Ms. Tanya Brewer, (301) 975-4534, tbrewer@nist.gov

Ms. Suzanne Lightman, (301) 975-6442, suzanne.lightman@nist.gov

Ms. Vicky Yan Pillitteri, (301) 975-8542, victoria.yan@nist.gov

The Networking and Information Technology Research and Development (NITRD) Program provides a framework in which many federal agencies come together to coordinate their networking and IT research and development (R&D) efforts. CSD remained committed to the value of communicating its R&D efforts to other federal colleagues and identifying the opportunities to support R&D efforts throughout the Federal Government.

In FY 2013, the CSIA Interagency Working Group (IWG) monthly meetings provided an opportunity to learn and share about ongoing research related to the themes and thrusts expressed in the Strategic Plan for the Federal Cybersecurity Research and Development. CSD briefed the working group regarding efforts on Executive Order 13636, “Improving Critical Infrastructure Cybersecurity,” under which NIST has been directed to work with stakeholders to develop a voluntary framework for reducing cyber risks to critical infrastructure. CSD also described work on the Advanced Network Technologies division’s High Assurance Domain project, which exists to foster development and deployment of new network security technologies to increase trust in online communications.

CSD is also a regular participant in the coordination activities of the federal Special Cyber Operations Research and Engineering (SCORE) Committee. SCORE enables technology transfer through the sharing of NIST cybersecurity expertise and output. The SCORE committee interacts with federal leaders as part of the White House’s Comprehensive National Cybersecurity Initiatives (CNCI).

Mr. Bill Newhouse, CSIA IWG, CSIA SSG, (301) 975-2869, william.newhouse@nist.gov

Dr. Ernest McDuffie, SEW Education Team and SCORE rep, (301) 975-8897, ernest.mcduffie@nist.gov

In 2002, Congress passed the Help America Vote Act (HAVA) to encourage the upgrade of voting equipment across the United States. HAVA established the Election Assistance Commission (EAC) and the Technical Guidelines Development Committee (TGDC), chaired by the Director of NIST. HAVA directs NIST to provide technical support to the EAC and TGDC in efforts related to human factors, security, and laboratory accreditation. As part of NIST’s efforts, CSD supports the activities of the EAC related to voting equipment security.

In the past year, NIST supported the EAC by developing responses to public comments on the Voluntary Voting System Guidelines (VVSG) 1.1. The security guidelines were updated in FY 2012 to improve the auditability of voting systems, to provide greater software integrity protections, to expand and improve access control requirements, and to help ensure cryptographic security mechanisms are implemented properly. In addition, CSD supported the efforts of the EAC and Federal Voting Assistance Program (FVAP) of DoD to improve the voting process for citizens under the Uniformed and Overseas Citizens Voting Act (UOCAVA) by leveraging electronic technologies. The team worked with the TDCG’s UOCAVA Working Group to develop a risk analysis on technologies used in current UOCAVA voting processes, including vote-by-mail, online voter registration, electronic ballot delivery, and online ballot marking.

In FY 2014, NIST will continue to assist the EAC in developing responses to public comments and providing updates to VVSG 1.1. Additionally, CSD will continue to support efforts for the EAC and FVAP to improve the voting process for UOCAVA voters. CSD will continue security research efforts to support future standards development efforts, particularly in the areas of risks to voting systems and innovative voting system architectures.

http://vote.nist.gov

Mr. Andrew Regenscheid, (301) 975-5155, andrew.regenscheid@nist.gov

Mr. Joshua Franklin, (301) 975-8463, joshua.franklin@nist.gov

Health information technology (HIT) enables better patient care through secure use and sharing of health information. It leads to improvements in healthcare quality, reduced medical errors, increased efficiencies in care delivery and administration, and improved population health. Central to reaching these goals is the assurance of the confidentiality, integrity, and availability of health information. CSD works with government, industry, academia, and others to provide security tools, technologies, and methodologies that provide for the security and privacy of health information.

NIST continued its HIT security outreach efforts in FY 2013. NIST and the Department of Health and Human Services’ (DHHS) Office for Civil Rights (OCR) cohosted the sixth annual HIPAA Security Rule conference, “Safeguarding Health Information: Building Assurance through HIPAA Security,” in May 2013 at the Ronald Reagan Building and International Trade Center in Washington, D.C. The conference offered important sessions that focused on broad topics of interest to the healthcare and health IT security community. Over 600 in-person and virtual attendees from federal, state, and local governments, academia, HIPAA-covered entities and business associates, industry groups, and vendors heard from, and interacted with, healthcare, security, and privacy experts on technologies and methodologies for safeguarding health information and for implementing the requirements of the HIPAA Security Rule. Presentations covered a variety of current topics including:

The keynote address was delivered by Eric Dishman, Fellow and General Manager of the Health Strategy & Solutions Group at Intel.

In FY 2014, NIST plans to issue a draft revision to Special Publication (SP) 800-66, An Introductory Resource Guide for Implementing the HIPAA Security Rule. As part of its continued outreach efforts, NIST also plans to co-host the seventh annual Safeguarding Health Information conference with OCR.

http://www.nist.gov/healthcare/security/

Mr. Kevin Stine (301) 975-4483 kevin.stine@nist.gov

Federal agency information systems are increasingly at risk of both intentional and unintentional supply chain compromise. The management of ICT supply chain risk includes ensuring the integrity, security, and resilience of the supply chain and the products and services it delivers (Figure 4). Today’s ICT supply chains have increased complexity, diversity, and scale. Federal Government information systems have rapidly expanded in terms of capability and number, with an increased reliance on outsourcing and commercially available products. These trends have caused federal departments and agencies to have a lack of visibility and understanding of how acquired technology is developed, integrated, and deployed. Supply chain risks also affect the processes, procedures, and practices used to assure the integrity, security, resilience, and quality of products and services. This lack of visibility and understanding, in turn, has decreased federal departments’ and agencies’ control regarding decisions affecting the inherited supply chain risks and the ability to manage those risks.

Figure 4: The Four Elements of ICT SCRM

Figure 5: ICT Supply Chain Risk

The ICT SCRM project seeks to provide federal agencies with a toolkit of standardized, repeatable, and practical resources to strategically manage supply chain risk throughout the entire lifecycle of systems, products, and services.

In October 2012, NIST held a workshop with industry, academic, and government stakeholders to discuss:

NIST used input from the workshop and additional stakeholder forums to begin developing an initial public draft of NIST SP 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations, which is scheduled to be finalized in FY 2014. This document provides guidance to federal departments and agencies on identifying, assessing, and mitigating ICT supply chain risks at all levels in their organizations and utilizes and builds on existing guidance in the unified information security framework.

Additionally in FY 2013, a grant was awarded to the University of Maryland’s Supply Chain Management Center to support the development and hosting of a web application with the following capabilities:

In FY 2014, CSD will continue its work to develop and publish draft NIST SP 800-161. It will research and develop tools and guidance to help agencies more effectively manage their ICT supply chain risk. Additionally, NIST will continue to co-chair Working Group 2 of the White House’s Comprehensive National Cybersecurity Initiative (CNCI) 11, Develop a Multi-Pronged Approach for Global Supply Chain Risk Management, and participate in national and international standards activities related to supply chain risk management. Feedback from organizations implementing ICT SCRM programs will be evaluated, and best practices will be accumulated. NIST will continue to engage stakeholders to identify needs and opportunities for providing additional guidance regarding identifying and implementing supply chain protections.

http://csrc.nist.gov/scrm/

ICT SCRM Team email: scrm-nist@nist.gov

Mr. Jon Boyens, Project Lead, (301) 975-5981, jon.boyens@nist.gov

Ms. Celia Paulsen, (301) 975-5549, celia.paulsen@nist.gov

In February 2012, Congress passed the Middle Class Tax Relief and Job Creation Act. One portion of this legislation calls for the establishment of a nationwide, interoperable public safety broadband network based on Long-Term Evolution (LTE) technology. The network will be deployed and operated by the First Responder Network Authority (FirstNet). The planned National Public Safety Broadband Network (NPSBN) will “create a much needed nationwide interoperable broadband network that will help police, firefighters, emergency medical service professionals and other public safety officials stay safe and do their jobs.” (http://www.ntia.doc.gov/category/public-safety). NIST is directed to establish a list of certified devices and required components for interacting with the nationwide network by public safety officials, vendors, and other interested parties. NIST is directed to conduct research and development that supports the acceleration and advancement of the nationwide network.

In FY 2013, CSD supported the joint National Telecommunications and Information Administration (NTIA) and NIST Public Safety Communications Research (PSCR) program (http://www.pscr.gov) efforts by developing and establishing security-related activities to support the proposed NPSBN. CSD presented details of the PSCR security-related activities at PSRC’s Annual Public Safety Broadband Stakeholder Conference in June 2013.

CSD provided comments and contributed text for the security-related aspects of the National Public Safety Telecommunications Council (NPSTC) Public Safety Broadband High-Level Launch Requirements, published in December 2012, that describe, in increasing levels of detail, the technical requirements of the NPSBN infrastructure, equipment, and communications.

CSD began participating in the standards development process for LTE technology within the 3rd Generation Partnership Project (3GPP) supporting public safety’s security requirements related to Proximity Services (ProSe) and Group Communication System Enablers (GCSE). In addition, CSD broadened its scope within the IETF to include efforts related to public safety.

In FY 2014, CSD will continue supporting NPSTC’s efforts related to NPSBN and to representing public safety in international standardization efforts, such as IETF and 3GPP. CSD will work to incorporate security capabilities into the PSCR’s Public Safety Broadband Demonstration Network located in Boulder, conduct research into identity management technologies for mobile devices that can support the NPSBN, and investigate ways to enhance the security of mobile applications used by the public safety community. CSD will continue to engage the public safety communications community by participating in events such as PSRC’s Annual Public Safety Broadband Stakeholder Conference.

Ms. Sheila Frankel, (301) 975-3297, sheila.frankel@nist.gov

Dr. Nelson Hastings, (301) 975-5237, nelson.hastings@nist.gov

Figure 6: Smart Meter

The major elements of the smart grid are the information technology, the industrial control systems, and the communications infrastructure used to send command information across the electric grid from generation to distribution systems, and to exchange usage and billing information between utilities and their customers. Key to the successful deployment of the smart grid infrastructure is the development of the cybersecurity strategy that includes cybersecurity as a design consideration for new and emerging systems, and an approach to adding cybersecurity into existing systems. The electric grid is critical to the economic and physical well-being of the nation, and emerging cyber threats targeting power systems highlight the need to integrate advanced security to protect critical assets.

In January 2013, the Smart Grid Interoperability Panel (SGIP) became a membership-supported organization. The SGIP Cybersecurity Working Group (CSWG) was renamed the Smart Grid Cybersecurity Committee (SGCC). All three of these groups have been led by a NIST representative since their respective creations, originating with the Cybersecurity Coordination Task Group (CSCTG), created by NIST in support of the Energy Independence and Security Act of 2007. The SGIP SGCC includes additional leadership by a management team, comprised of three volunteer vice-chairs representing the Department of Energy (DOE), an electric utility, and a smart grid vendor, and a volunteer secretariat.

During the past year, members of the CSWG/SGCC worked to revise NISTIR 7628, Guidelines for Smart Grid Cybersecurity, to address changes in technologies and implementations since the publication’s original release. The revision updates and expands the development strategy, cryptography and key management, privacy, vulnerability classes, research and development topics, standards review, and key power system use cases to reflect changes in the smart grid environment since 2010. The final version is expected to be posted in FY 2014.

In addition to the revision of NISTIR 7628, the CSWG/SGCC has focused on specific topics such as cybersecurity risk management, security architecture, security testing and certification, Advanced Metering Infrastructure (AMI) security, the development of a User’s Guide for NISTIR 7628, and cloud computing and privacy for the smart grid. Work in these areas is completed through SGCC subgroups, which are created and disbanded in order to meet present needs. The SGCC currently consist of the following subgroups:

An example of a SGCC deliverable in 2013 is the analysis of cybersecurity regulations relevant to electricity subsector stakeholders and of NIST security guidance. The analysis identifies the relationship, similarities, and differences among NISTIR 7628, SP 800-53, and the draft North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection Standards (CIP) v5, recognizing that each document has a different scope and audience.

The SGCC also supports the SGIP Catalog of Standards (CoS), a compendium of standards, practices, guidelines and other technical documents considered relevant for the development of a robust, secure, and interoperable smart grid. Through the ongoing efforts of the SGCC, these documents are reviewed for cybersecurity, and recommendations are made for how to include cybersecurity in future revisions and in the implementation of the standards. CSD supports the SGCC in assessing the security of cryptographic methods used in these standards, practices, guidelines, and other technical documents. In many cases, the standards bodies have taken the results of the reviews and modified the standards or documents to address our recommendations. The SGCC has worked closely with some of the standards bodies to ensure that the recommendations are interpreted correctly and that the mitigation strategies selected meet the intent of the NISTIR 7628 high-level security requirements. The result is cybersecurity “baked-in” to the standards rather than “bolted-on” after the standard is implemented.

In FY 2014, CSD will continue to support the SGCC in the evaluation of the cryptographic methods used standards, practices, guidelines, and other technical documents for inclusion in the SGIP CoS.

Future activities include working with the SGIP Committees, Domain Expert Working Groups, and Priority Action Plans to integrate cybersecurity into their work efforts. The SGCC will establish a new subgroup to produce a cybersecurity risk management process case study to accompany the Department of Energy Risk Management Process guideline. Members of the committee will produce white papers on security defense in depth and breadth, unique cloud computing considerations for the smart grid, as well as a User’s Guide for NISTIR 7628. Additionally, the SGIP SCCC will continue to collaborate with industry, academia, other working groups, and government agencies to address the cybersecurity needs for the smart grid.

In addition to the SGIP SGCC activities, CSD will also coordinate with NIST’s Engineering Laboratory (EL) and Smart Grid Program Office on the development of a Cybersecurity Smart Grid Test Lab, part of the NIST Smart Grid Testbed Facility now under construction. CSD will also collaborate with ITL’s Software and Systems Division on cybersecurity research in relation to the IEEE 1588, Precision Time Protocol, a standard on time synchronization that is used for the electric grid and other special-purpose industrial automation and measurement networks.

http://www.sgip.org

Ms. Vicky Yan Pillitteri, (301) 975-8542, victoria.yan@nist.gov

Ms. Tanya Brewer, (301) 975-4534, tbrewer@nist.gov

Mr. Quynh Dang, (301) 975-3610, qdang@nist.gov

NIST has served as the lead for the National Initiative for Cybersecurity Education (NICE) since 2010. NICE is responsive to President Obama’s declaration that the “cyber threat is one of the most serious economic and national security challenges we face as a nation” and “America’s economic prosperity in the 21st century will depend on cybersecurity.”

The goal of NICE is to enhance the overall cybersecurity posture of the United States by accelerating the availability of educational and training resources designed to improve the cyber behavior, skills, and knowledge of every segment of the population, enabling a safer cyberspace for all. NICE addresses this challenging goal by:

This initiative comprises four component areas:

CSD is home to the NIST NICE Leadership Team (NNLT) that focuses on the following activities:

In FY 2013, NIST stewarded the National Cybersecurity Workforce Framework (NCWF), developed within NICE’s Cybersecurity Workforce Training and Professional Development Component, through government-wide review. NIST also planned, organized and hosted the fourth annual NICE Workshop, “Navigating the National Cybersecurity Education Interstate Highway,” from September 17-19, 2013. The workshop highlighted cybersecurity awareness, education, and training programs that can be adopted, copied, used, or built-on by small businesses, educational institutions, industry, and government at the state, local, tribal and federal levels to advance the strategic goals of NICE.

The NNLT attended more than 100 events, symposia, forums, competitions, educational outreach meetings, and workshops to promote the activities within NICE. The NNLT worked with the Office of Personnel Management (OPM) on the OPM Cross-Agency Priority Goal: “Closing Skills Gap” for IT/Cybersecurity and on the OPM Special Cybersecurity Workforce Project focused on reducing cybersecurity workforce skills gaps. The project will allow agencies to identify and address their needs for cybersecurity skill sets to meet their missions. In accomplishing this project, agencies will also be updating their cybersecurity positions with codes that revise the definitions of and taxonomy used for cybersecurity work. In FY 2013, the NNLT supported DHS in the launch of the National Initiative for Cybersecurity Careers and Studies (NICCS), (http://niccs.us-cert.gov), an online resource for cybersecurity career, education, and training information. NICCS leverages efforts of government, industry, and academia to provide a comprehensive, single resource to address the nation’s cybersecurity knowledge needs.

In FY 2014, NIST will continue to promote the coordination of existing and future cybersecurity education, training, and awareness activities while planning the transition of NICE leadership. NIST will also identify opportunities to extend and integrate NICE activities to raise cybersecurity awareness in the context of other sectors, and promote the NCWF as a resource to be used to identify workforce gaps, lead bi-weekly NICE component meetings, and continue to conduct broad outreach on the NICE program.

http://www.nist.gov/nice/

Dr. Ernest McDuffie, NICE Project Lead, (301) 975-8897, ernest.mcduffie@nist.gov

Mr. Bill Newhouse, NICE Program Lead, (301) 975-2869, william.newhouse@nist.gov

During FY 2013, CSD continued its efforts to improve the quality of information about its publications on various NIST websites. CSD also explored new ways to make those publications available to CSD’s customers, who access CSD’s technical security publications in various ways: (1) directly from the CSRC website, (2) through the NIST Publications Portal, via Internet search or (3) direct links from digital content, or (4) from external information providers. By the end of FY 2013, CSD had more than 270 current publications in the NIST technical series (FIPS, Special Publications (SPs) and NISTIRs).

Providing accurate metadata about publications improves users’ abilities to locate the information they are seeking. In FY 2013, CSD cleaned up the NIST Publications Portal records and PDF metadata for all of its NIST technical series publications and for more than 100 journal articles and conference papers co-authored by CSD staff in recent years. By improving the metadata—such as title, authors, report numbers and keywords—within the PDFs themselves, Internet searches provide more informative results and make NIST’s security publications easier to find. CSD continues to apply those consistent metadata practices to all new publications.

Additionally, CSD expanded the dissemination of its publications to the Association for Computing Machinery (ACM) Digital Library (DL). ACM DL now has a “collection” of NIST Computer Security Publications, which includes SP 800-series publications. CSD initiated an internal project to test the feasibility of creating electronic book (e-book) editions of its FIPS, SPs and NISTIRs, to supplement the PDF editions currently available on CSRC. The aim is to provide a wider range of options for CSD customers to view and use CSD’s technical publications. The pilot project uses the EPUB file format, an open standard for e-books from the International Digital Publication Forum (IDPF). CSD intends to begin posting EPUB versions of selected publications in FY 2014, which will especially benefit users of mobile devices.

In FY 2014, CSD intends to explore more ways to improve the consistency of its publications and associated metadata, enhance users’ ability to browse and search publications on CSRC, make more e-book editions available, and expand publication availability on external sites.

http://csrc.nist.gov/publications/

Mr. Jim Foti, (301) 975-8018, jfoti@nist.gov

The Computer Security Resource Center (CSRC), CSD’s website, is one of the most visited websites at NIST. CSRC encourages broad sharing of information security tools and practices, provides a resource for information security standards and guidelines, and identifies and links key security web resources to support industry and government users. CSRC is an integral component of all of the work that CSD conducts and produces. It is CSD’s repository for anyone wanting to access these documents and other valuable security-related information. During FY 2013, CSRC had more than 53 million page views and downloads.

Figure 7: Total Number of CSRC Website Requests for 2013 (Oct. 1, 2012 to Sept. 30, 2013)

CSRC is the primary gateway for gaining access to NIST computer security publications, standards, and guidelines, and serves as a vital link to CSD’s customers. Publications are organized to help users locate relevant information quickly and are arranged by topic, relevant security control family, and legal requirements.

During FY 2013, the top ten most downloaded publications were:

In the FIPS publication series, the top three most downloaded FIPS were:

In the SP publication series, the top three most downloaded SPs were:

In the NISTIR publication series, the top three most downloaded NISTIRs were:

In addition to CSRC, CSD maintains a publication announcement mailing list. This free email list notifies subscribers about publications that have been posted to the CSRC website. The email list is a valuable tool for more than 28,000 subscribers from the Federal Government, industry, academia, and individuals with a personal interest in IT security. Individuals who are interested in subscribing to this list should visit http://csrc.nist.gov/publications/subscribe.html for more information.

Questions on the website should be sent to the CSRC Webmaster at: webmaster-csrc@nist.gov.

Mr. Patrick O’Reilly (301) 975-4751 patrick.oreilly@nist.gov

Ms. Judy Barnard (301) 975-5502 jbarnard@nist.gov

The Federal Computer Security Program Managers’ Forum is sponsored by NIST to promote the sharing of security-related information among federal agencies. The Forum, which serves more than 1,100 members, strives to provide an ongoing opportunity for managers of federal information security programs to exchange information security materials in a timely manner, build upon the experiences of other programs, and reduce possible duplication of effort. It provides a mechanism for NIST to share information directly with federal agency information security program managers in fulfillment of NIST’s leadership mandate under FISMA. It assists NIST in establishing and maintaining relationships with other individuals or organizations that are actively addressing information security issues within the Federal Government. NIST serves as the Secretariat of the Forum, providing necessary administrative and logistical support. Kevin Stine serves as the Chairperson.

The Forum maintains an extensive email subscription service. Participation in the service is only open to Federal Government employees who participate in the management of their organization’s information system security program. There are no membership dues. The Forum also holds bimonthly meetings and an annual 2-day conference to discuss current issues and developments of interest to those responsible for protecting sensitive (unclassified) federal systems. Participation in Forum meetings is open to Federal Government employees, and their designated support contractors, who participate in the management of their organization’s information security program.

Topics of discussion at Forum meetings in FY 2013 included briefings from various federal agencies on Preparing for and Responding to Certification Authority Compromise and Fraudulent Certificate Issuance; Software Assurance: Enabling Security throughout the Software Development Lifecycle; Use of Cybersecurity Function Code; Census Risk Management Program Implementation; National Cybersecurity Center of Excellence (NCCoE); demonstration of Trusted Geolocation in the Cloud; and Policy Machine: Enabling an Enterprise-wide, Data Centric Computing Environment.

This year’s annual 2-day offsite meeting featured updates on the computer security activities of the Government Accountability Office (GAO), General Services Administration (GSA), Bureau of the Fiscal Service, and NIST. Recent administration guidance directing federal agencies to reduce travel and conference budgets significantly reduced attendance. Technical sessions included briefings on evolving cybersecurity strategies, IT security concerns during a consolidation (merger), supply chain risk management activities, the National Vulnerability Database (NVD), SP 800-53 Revision 4, continuous monitoring, industrial control systems security, and EO 13636.

On August 8, 2013, a Cybersecurity and Risk Management Training Workshop was held at the Department of Commerce with over 500 registrants. Attendees gained a greater understanding of the Risk Management Framework (RMF) and its practical application. Dr. Ron Ross discussed SP 800-53 Revision 4 and the fundamentals of continuous monitoring. Two afternoon panels discussed case studies regarding RMF and “ongoing authorization.”

The Forum plays a valuable role in helping NIST and other federal agencies to develop and maintain a strong, proactive stance in the identification and resolution of new strategic and tactical IT security issues as they emerge. The number of members on the email list has grown steadily and provides a valuable resource for federal security program managers. To join, email your name, affiliation, address, phone number, title, and confirmation that you are a federal employee to sec-forum@nist.gov.

http://csrc.nist.gov/groups/SMA/forum/

Mr. Kevin Stine Chair (301) 975-4483 kevin.stine@nist.gov

Ms. Peggy Himes Administration (301) 975-2489 peggy.himes@nist.gov

The Federal Information Systems Security Educators’ Association (FISSEA), founded in 1987, is an organization run by and for information systems security professionals to assist federal agencies in meeting their information systems security awareness, training, and education responsibilities. FISSEA strives to elevate the general level of information systems security knowledge for the Federal Government and the federal workforce. It also seeks to assist the professional development of its members.

FISSEA membership is open to information systems security professionals, professional trainers and educators, and managers responsible for information systems security training programs in federal agencies, as well as contractors of these agencies and faculty members of accredited educational institutions who are involved in information security training and education. There are no membership fees to join FISSEA; all that is required is a willingness to share products, information, and experiences. A working group meets monthly to administer business activities

FISSEA maintains a website, a mailing list, and participates in a social networking site as a means of communication for its members. NIST assists FISSEA with its operations by providing staff support for several of its activities and by being FISSEA’s host agency.

FISSEA membership in 2013 spanned federal agencies, industry, military, contractors, state governments, academia, the press, and foreign organizations to reach over 1,395 members in a total of ten countries. The 700 federal agency members represent 89 agencies from the executive and legislative branches of government.

The 26th Annual FISSEA Conference occurred March 19-21, 2013, at NIST. Approximately 140 information systems security professionals and trainers attended from federal agencies, academia, as well as industry representatives from firms that support federal information systems and security programs.

Recent government sequestration efforts prevented some from receiving permission to attend, which had a noticeable effect on attendance. NIST’s Pat Toth and Peggy Himes, as well as Gretchen Morris, Susan Hansche, and other members of the FISSEA Technical Working Group, were integral to the effort to support the conference.

This year’s theme was, “Making Connections in Cybersecurity and Information Security Education,” to solicit presentations that reflect current projects, trends, and initiatives that provide for future solutions in federal security programs. Attendees gained new techniques for developing/conducting training, cost-effective practices, workforce development, free resources and contacts, as well as an update on NICE activities.

NIST ITL Computer Security Division Deputy Chief, Matthew Scholl, welcomed attendees. Keynote presentations were given by John J. Suess, VP of IT & CIO, University of Maryland, Baltimore County; Bryant Tow, Vice President, InfraGard National Members Alliance; and Lamont Hames, Chief Development Officer, UNCF Special Programs Corporation. Mr. Hames presented on Expanding the Role of Minorities in Cyber Security.

Presenters represented NIST, DHS, DOS, DOE, NSA and the Library of Congress as well as private industry and academia. Conference attendees had the opportunity to visit vendors, receive a government best practice poster, and attend a demonstration session, which provided an opportunity for agencies to share about their specific awareness and training programs.

Traditional FISSEA conference events included announcing the winners of FISSEA contests and awarding prize drawings. Susan Hansche, Avaya Gov/U.S. Department of State, presented the FISSEA Educator of the Year plaque to Mr. J. Paul Wahnish, Career Technical Education Foundation, Inc., for his work in preparing the future workforce. The FISSEA Security Awareness, Training & Education Contest includes five categories from one of FISSEA’s three key areas of Awareness, Training, and Education. The winner is selected from each category and awarded a certificate. The categories include: (1) awareness poster, (2) motivational item (e.g., pens, stress relief items, t-shirts), (3) awareness website, (4) awareness newsletter, and (5) role-based training & education.

The winners of the 2013 FISSEA Awareness, Training, and Education Contest are:

Conference attendees selected their Peer’s Choice Awards, and they are...

New this year was the Pecha Kucha session on the third day. During Pecha Kucha (Lightning Round) speakers had 6 minutes 40 seconds to present a limited number of slides (20 slides at most), and only 20 seconds per slide. The presentation method is challenging for the speaker and enjoyable for audience members. There were four participants and their fast-paced talks proved to be lively and entertaining.

Attendee networking is a valuable benefit of attending the FISSEA conference. The conference continues to be a valuable forum in which individuals from government, industry, and academia who are involved with information systems/cybersecurity workforce development (awareness, training, education, certification, and professionalization) learn of ongoing and planned training and education programs and initiatives. It provides NIST the opportunity to provide assistance to departments and agencies as they work to meet their FISMA responsibilities.

The 2014 FISSEA conference is planned for March 18-20, 2014, at NIST.

http://csrc.nist.gov/fissea

fisseamembership@nist.gov

Ms. Patricia Toth, (301) 975-5140, patricia.toth@nist.gov

Ms. Peggy Himes, (301) 975-2489, peggy.himes@nist.gov

The ISPAB was originally created by the Computer Security Act of 1987 (P.L. 100-235) as the Computer System Security and Privacy Advisory Board, and amended by Public Law 107-347, The E-Government Act of 2002, Title III, The Federal Information Security Management Act (FISMA) of 2002. The statutory objectives of the Board include identifying emerging managerial, technical, administrative, and physical safeguard issues relative to information security and privacy.

In drafting the Computer Security Act of 1987, which created this Advisory Board, the Congress saw a need for an independent, non-federally dominated group of computer security experts to offer its advice to senior government officials on emerging computer security areas. The Board members, with their individual and collective skills, responsibilities, and experiences fulfill this requirement. No other similar group of experts meets regularly to review information security issues involved in unclassified Federal Government computer systems and networks. Also, Title III of the E-Government Act of 2002 reaffirmed the need for this Board by giving it additional responsibilities.

The ISPAB’s statutory purpose is to advise the Secretary of Commerce, the Director of the NIST, and the Director of the OMB on information security and privacy related issues. Title III of the E-Government Act of 2002 also mandated the Board to thoroughly review all of the proposed information technology standards and guidelines developed under Section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) as amended.

The charter (http://csrc.nist.gov/groups/SMA/ispab/documents/ispab_charter-2012-2014.pdf) defines that the Board’s membership should consist of 12 members and a Chairperson. The Secretary of Commerce appoints the Chairperson, and the Board members are selected for their preeminence in the information technology industry or related disciplines. The term of office for each board member is four years.

The Board is comprised of members from a broad range of interested parties. There are three main categories and each category has four members. Category 1 includes members from outside the Federal Government eminent in the information technology industry, at least one of whom is representative of small or medium-sized companies in such industries. Category 2 also includes members from outside the Federal Government and not employed by or representative of a producer of information but are eminent in the field of information technology, or related disciplines. Category 3 includes experienced information system managers from the Federal Government, including those with experience in information security and privacy, at least one of whom should be from the National Security Agency. Federal members bring a detailed understanding of the federal processing environment; industry brings concerns and experiences regarding product development and market formation, while private computer security experts are able to bring their experiences of commercial cost-effective security measures into Board discussion.

From Left to Right: Tatiana Laszczak, Chris Boyer, Annie Sokol, Ed Roback, Greg Garcia, Matt Thomlinson (Chair), Peter Weinberger, John Centafont, Toby Levin, Matt Scholl, Gale Stone.Not Present for photo: Julie Boughn

In October 2012, Matt Thomlinson agreed to assume the responsibilities of Chairperson from Dan Chenok. The Board expressed its gratitude to Dan Chenok for his leadership and contributions to ISPAB both as a member and Chair since 2005. Presently, ISPAB has nine members and a Chairperson. The ISPAB Board members are:

During FY 2013, ISPAB held three meetings, all held in Washington D.C:

It is of particular interest to mention ISPAB’s involvement with the EO Cybersecurity Framework and that prior to opening the ISPAB meeting on February 15, 2013, the Board attended the presentation of cybersecurity policy discussion and launch of the Executive Order (EO) to improve the Cybersecurity of the U.S.’s critical infrastructure at the U.S. Department of Commerce. The President signed the EO and also approved the presidential directive to improve the security and resilience of critical infrastructure in both the cyber and physical realms. Dr. Patrick Gallagher, Under Secretary of Commerce for Standards and Technology and NIST Director, provided the opening remarks on the EO. A group of distinguished panelists presented more information:

ISPAB meeting agendas are established based on the Board’s list of emerging issues developed from previous meetings. The meeting agenda topics also include non-work list items that are of immediate security and privacy concerns to the Board. During FY 2013, the Board provided guidance on many issues relating to security and privacy such as:

The presenters at every Board meeting were leaders and experts from private industries, academia, federal agency CIOs, IGs and CISOs.

Copies of the current list of members and their bios, the Board’s charter and past Board activities can be located at http://csrc.nist.gov/groups/SMA/ispab. Information on ISPAB Meetings is published in Federal Register Notice at least 16 days prior to the meeting. Those interested in receiving meeting notices may email name, affiliation, and address to:

Ms. Annie Sokol DFO, ISPAB (301) 975-2006 annie.sokol@nist.gov

Small business owners face a broad range of information security issues. A computer failure or system breach could jeopardize the company’s reputation and may result in significant damage and recovery cost or going out of business. The small business owner who recognizes the threat of computer crime and takes steps to deter inappropriate activities is less likely to become a victim.

The U.S. Small Business Administration (SBA) reports that over 27 million U.S. companies - more than 99 percent of all U.S. businesses - are SMBs of 500 employees or fewer (http://www.sba.gov/sites/default/files/allprofiles12.pdf). While the threats to individual SMBs may not be significantly different from those facing larger organizations, a SMB frequently has fewer resources available to protect systems, detect attacks, or respond to security issues. A vulnerability common to a large percentage of SMBs could pose a threat to the nation’s information infrastructure and economic base.

To help address information security risk, these businesses require assistance with identification of security mechanisms and with practical, cost-effective training. Training helps SMB’s use their limited resources most effectively to address relevant and serious threats. In response to this need, NIST, the SBA, and the Federal Bureau of Investigation (FBI) co-sponsor a series of cyber security training workshops for small businesses. These workshops provide an overview of cyber security threats, vulnerabilities, and corresponding protective tools and techniques, with a special emphasis on information that small business personnel can apply directly.

In FY 2013, the SMB outreach team provided 15 workshops in 15 cities: Toledo, Ohio; Burlington, Vermont; Portland, Maine; Providence, Rhode Island; Lexington, Kentucky; Louisville, Kentucky; Pittsburgh, Pennsylvania; Cleveland, Ohio; Detroit, Michigan; Portland, Oregon; Little Rock, Arkansas; Shreveport, Louisiana; Alexandria, Louisiana; Ruston, Louisiana; and Monroe, Louisiana.

In collaboration with the SBA and the FBI, CSD is planning locations for small business cyber security workshops in FY 2014.

http://sbc.nist.gov

Mr. Richard Kissel, (301) 975-5017, richard.kissel@nist.gov

In response to vulnerabilities discovered in 2005 in the NIST-approved, government hash algorithm standard, SHA-1, NIST opened a public competition in 2007 to develop a new cryptographic hash algorithm, SHA-3, to augment the hash algorithms specified in FIPS 180-4, Secure Hash Standard. After 64 entries, 3 rounds of the competition, and 5 years of intensive analysis, provided mostly by the world cryptographic community, NIST announced the selection of Keccak as the winning algorithm on October 2, 2012, and summarized its decision in NISTIRs after each round.

After the competition had ended, NIST invited the winning team to NIST in February 2013, and hosted a 2-day workshop to discuss the Keccak features and options for standardization as the new SHA-3 hash standard. CSD developed a standardization plan and shared with the Keccak designers and subsequently with the cryptographic community at the 2013 RSA Conference, the 2013 Workshop on Cryptographic Hardware and Embedded Systems (CHES), and at the IETF 86 and 87 Workshops. In addition, this standardization plan was posted at the NIST hash website for public comment.

A draft of the SHA-3 Permutation-based Hash Standard (Draft FIPS 202) is being finalized, and NIST is preparing a Federal Register Notice to announce this draft standard. NIST expects to release the draft standard during FY 2014 and plans a 60-day public comment period. After the comment period closes, NIST will analyze the comments, make changes to the document, as appropriate, and propose the draft standard to the Secretary of Commerce for approval as a FIPS. In addition to publishing FIPS 202 in FY 2014, NIST is also considering standardizing a generic “tree hashing” mode and other Keccak features. NIST plans to host a workshop in FY 2014 to discuss these options.

Information about the SHA-3 competition and the SHA-3 standardization effort is available at http://www.nist.gov/hash-competition.

Ms. Shu-jen Chang, (301) 975-2940, shu-jen.chang@nist.gov

CSD’s Cryptographic Technology Group (CTG) is responsible for the maintenance and development of the FIPS 180-4, Secure Hash Standard (SHS). A hash algorithm processes a message, which can be very large, and produces a condensed representation, called a message digest. A cryptographic hash algorithm is a fundamental component of many cryptographic functions, such as digital signature algorithms, key derivation functions, keyed-hash message authentication codes, and random number generators. Cryptographic hash algorithms are frequently used in Internet protocols and other security applications.

FIPS 180-4 specifies seven hash algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224 and SHA-512/256. Their security properties in different cryptographic applications are discussed in SP 800-107, Revision 1, Recommendation for Applications Using Approved Hash Algorithms.

CSD authored an article, “Changes in Federal Information Processing Standard (FIPS) 180-4, Secure Hash Standard,” which was published in the January 2013 issue of the journal Cryptologia. The article describes the rationale behind the standardization of the SHA-512/224 and SHA-512/256 hash algorithms in FIPS 180-4 and the performance advantage of these two hash algorithms over the SHA-224 and SHA-256 hash algorithms. This article was written to help the adoption of the two new hash algorithms in security protocols and applications to improve performance.

Mr. Quynh Dang (301) 975-3610 quynh.dang@nist.gov

Ms. Elaine Barker (301) 975-2911 elaine.barker@nist.gov

SP 800-52, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations, provides recommendations regarding TLS server and client implementations. TLS is a widely used cryptographic protocol that provides communication security for a variety of network applications, such as email, e-commerce, and healthcare.

The first version of SP 800-52, published in 2005, was withdrawn in March 2013. A draft of SP 800-52 Revision 1 was issued for public review and comment in September 2013. The revision is a substantially different document than the original and includes recommendations providing higher levels of security, both for TLS and aspects of the Public Key Infrastructure (PKI) that TLS relies on. New recommendations include the support of TLS versions 1.1 and 1.2, guidance on certificate profiles and validation methods, TLS extensions, and support for a greater variety of cryptographic algorithms.

The final version of SP 800-52 Revision 1 will be published in FY 2014.

Dr. Kerry McKay (301) 975-4969 kerry.mckay@nist.gov

Dr. Lily Chen (301) 975-6974 lily.chen@nist.gov

Random numbers provide the required security for many cryptographic algorithms. For example, random numbers are used to generate the keys needed for encryption and digital signature applications.

In the late 1990s, a project to develop more rigorous requirements and specifications for random number generation (RNG) was initiated in coordination with the American National Standards Institute’s (ANSI) Accredited Standards Committee (ASC) X9. The resulting standard (X9.82) contains four parts: Part 1 provides general information; Part 2, which is nearing completion, will provide requirements for entropy sources; Part 3 provides specifications for deterministic random bit generator (DRBG) mechanisms; and Part 4 provides guidance on constructing random bit generators (RBGs) from entropy sources and DRBG mechanisms.

In March 2007, NIST published SP 800-90, Recommendation for Random Number Generation Using Deterministic Random Bit Generators, which contained the DRBG mechanisms in Part 3 of ANS X9.82, plus an additional DRBG mechanism. This recommendation was revised as SP 800-90A, Recommendation for Random Number Generation Using Deterministic Random Bit Generators, in January 2012 to include additional capabilities identified during the development of Part 4 of ANS X9.82. Two additional documents (SP 800-90B, Recommendation for the Entropy Sources Used for Random Bit Generation and SP 800-90C, Recommendation for Random Bit Generator (RBG) Constructions) are under development and are available for public comment. SP 800-90B addresses the development and testing of entropy sources, including descriptions of the validation tests for NIST’s Cryptographic Algorithm Validation Program to validate candidate entropy sources. SP 800-90C provides basic guidance on the construction of RBGs from entropy sources and DRBG mechanisms.

CSD held a workshop in December 2012 to discuss the drafts of SP 800-90B and C, after which NIST began the adjudication of the comments received during the public comment period and the workshop.

In September 2013, articles from major news organizations based on leaked classified documents raised public concern that one of the DRBGs specified in SP 800-90A, the Dual_EC_DRBG, could contain a backdoor. This could allow attackers to successfully predict the secret cryptographic keys that form the foundation for the assurances provided by security products. Taking these concerns seriously, NIST assured the community of its commitment to producing strong cryptographic standards, and took immediate steps to examine and remediate the issue.

Shortly after these concerns were raised, CSD published an ITL Bulletin that provided a high-level discussion of the issues, reopened the SP 800-90 series of publications for public comment, and recommended that the Dual_EC_DRBG no longer be used, pending the resolution of the comments. Since that time, NIST has released a revised draft of SP 800-90A that removes the questioned algorithm and addresses other issues that were identified in the public comment process. NIST intends to finalize the revised SP800-90A publication in FY14.

Ms. Elaine Barker, (301) 975-2911, elaine.barker@nist.gov

Mr. John Kelsey, (301) 975-5101, john.kelsey@nist.gov

NIST continues to provide guidelines on cryptographic key management for the Federal Government, and to coordinate with other national and international organizations, industry, and academia. The guidelines are available at http://csrc.nist.gov/publications.

SP 800-56A, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography, specifies approved methods for key establishment using Diffie-Hellman and Menezes-Qu-Vanstone (MQV) schemes. This document was first published in 2006 and was revised in May 2013 to provide further clarification and additional methods for key derivation.

SP 800-56B, Recommendation for Pair-Wise Key Establishment Schemes Using Integer Factorization Cryptography, was first published in August 2009. It is under revision to provide further clarification and additional methods for key derivation; these changes are consistent with those made in SP 800-56A. The revision of SP 800-56B will be available for public comment in FY 2014.

SP 800-57, Recommendation for Key Management, Part 3: Application-Specific Key Management Guidance, was first published in 2009. A revision of this document has been under development. The revision will include an additional section on the Secure Shell (SSH) protocol and the removal of the Transport Layer Security (TLS) section, which is now being addressed in SP 800-52, Revision 1, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations. The revised SP 800-57, Part 3 will be available for public comment in FY 2014.

SP 800-130, A Framework for Designing Cryptographic Key Management Systems, was completed in August 2013 and provides guidance on a Cryptographic Key Management System (CKMS) framework.

SP 800-152, A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS), is under development. This document is intended to provide refinements of the framework requirements in SP 800-130 that are appropriate for use in a CKMS employed by the Federal Government, plus guidance on its implementation, procurement, installation, configuration, and operation. This document will be available for public comment in early FY 2014.

A new publication will provide guidance on the security strength of a cryptographic key that is used to protect data (i.e., a data-protection key), given the manner in which the key was generated and handled prior to its use to protect the target data. This document, SP 800-158, Key Management: Obtaining a Targeted Security Strength, involves a considerable amount of new research, since it is an area that has not been fully addressed to date. This publication will be available for public comment in FY 2014.

http://csrc.nist.gov/groups/ST/key_mgmt/

Ms. Elaine Barker, (301) 975-2911, elaine.barker@nist.gov

Dr. Dustin Moody, (301) 975-8136, dustin.moody@nist.gov

Dr. Lily Chen, (301) 975-6974, lily.chen@nist.gov

Mr. Ray Perlner, (301) 975-3357, ray.perlner@nist.gov

Mr. Quynh Dang, (301) 975-3610, quynh.dang@nist.gov

FIPS 186-4, Digital Signature Standard (DSS), specifies three techniques for the generation and verification of digital signatures that can be used for the protection of data: the Digital Signature Algorithm (DSA), the Elliptic Curve Digital Signature Algorithm (ECDSA), and the Rivest-Shamir-Adleman (RSA) algorithm. A digital signature is represented in a computer as a string of bits and is computed using a set of rules and a set of parameters that allow the identity of the signatory and the integrity of the data to be verified.

FIPS 186, first published in 1994, has been revised several times since then. In FY 2013, the Secretary of Commerce approved the latest version of the standard, FIPS 186-4.

Ms. Elaine Barker, (301) 975-2911, elaine.barker@nist.gov

Dr. Allen Roginsky, (301) 975-3603, allen.roginsky@nist.gov

The engine for many of the techniques in NIST’s cryptographic toolkit is a block cipher algorithm, such as the Advanced Encryption Standard (AES) algorithm or the Triple Data Encryption Algorithm (TDEA). A block cipher transforms some fixed-length binary data (i.e., a “block”) into seemingly random data of the same length. The transformation is determined by the choice of some secret data called the “key.” The key can also be used to recover the original block of data.

A method of using the block cipher to protect one or more blocks of data is called a block cipher mode of operation. The approved modes are specified in the SP 800-38 series. Each approved mode provides data confidentiality and/or authenticity/integrity.

In December 2012, NIST approved block cipher modes for key wrapping (i.e., the protection of the confidentiality and integrity of cryptographic keys). In particular, SP 800-38F, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping, identifies existing methods that are approved for key wrapping, and also specifies three deterministic authenticated-encryption modes: the AES Key Wrap (KW) mode, the AES Key Wrap with Padding (KWP) mode, and one TDEA mode, called TKW.

Block cipher modes can also provide format-preserving encryption (FPE). A format can be a sequence of decimal digits, such as a credit card number or a social security number; formats can also be defined for other sets of characters besides decimal digits. FPE is expected to be very useful because this property facilitates the retrofitting of encryption to existing applications.

NIST proposed the approval of three block cipher modes for FPE in Draft SP 800-38G, Recommendation for Block Cipher Modes of Operation: Methods for Format-Preserving Encryption, which was released for a 60-day period of public comment in July 2013. This publication specifies three schemes for FPE: FF1, FF2, and FF3. These schemes were submitted for NIST’s consideration in recent years under the names FFX-base, VAES3, and BPS; the original submission documents are available at http://csrc.nist.gov/groups/ST/toolkit/BCM/modes_development.html, in the FFX and BPS entries under the heading “Encryption Modes.”

Dr. Morris Dworkin, (301) 975-2354, morris.dworkin@nist.gov

In FY 2013, NIST researchers Stephen Jordan, Yi-Kai Liu, Dustin Moody, Ray Perlner, and Daniel Smith-Tone internally presented status reports in the areas of quantum computation, coding-based cryptography, lattice-based cryptography, and multivariate cryptography, which included detailed surveys of the respective fields, as well as security overviews and specific results. The project members also created evaluation criteria to compare proposed post quantum cryptosystems with the end goal of standardization.

NIST also engaged the international cryptographic community with presentations and publications. Daniel Smith-Tone and Ray Perlner presented a paper at PQCrypto 2013, in addition to Dr. Smith-Tone speaking at the Joint Romanian Mathematical Society, and the Quantum Cryptanalysis Seminar in Schloss Dagstuhl, Germany. Yi-Kai Liu presented his research at QCrypt 2013, as well as giving a talk at the European Telecommunication Standard Institute (ETSI) Quantum-safe Crypto Workshop. Lily Chen also spoke at the ETSI Quantum-safe Crypto Workshop. Stephen Jordan delivered a keynote address at the 16th Workshop on Quantum Information Processing on a paper that was published in Science magazine. In FY 2013, Dr. Jordan also spoke about research at the Institute for Quantum Information and Matter, the Hughes Research Laboratory, and the Lorentz Center, as well as submitting some research papers for publication.

In FY 2014, NIST will continue to explore the security capacity of purported quantum-resistant technologies with the ultimate goal of uncovering the fundamental mechanisms necessary for efficient, trustworthy, and cost-effective information assurance in the post-quantum market. Upon the successful completion of this phase of the project, NIST will be prepared for possible standardization efforts in this area. NIST will consider hosting a workshop on post-quantum cryptography to discuss practical steps towards this goal.

Email project Team: pqc@nist.gov

Dr. Dustin Moody, (301) 975-8136, dustin.moody@nist.gov

Dr. Lily Chen, (301) 975-6974, lily.chen@nist.gov

Mr. Ray Perlner, (301) 975-3357, ray.perlner@nist.gov

Dr. Daniel Smith-Tone, (502) 852-6010, daniel.smith@nist.gov

Dr. Yi-Kai Liu, (301) 975-6499, yi-kai.liu@nist.gov

NIST has implemented a public source of randomness. The prototype uses two independent, commercially available sources of randomness, each with an independent hardware entropy source.

The Beacon is designed to provide unpredictability, autonomy, and consistency. Unpredictability means that users cannot algorithmically predict bits before they are made available by the source. Autonomy means that the source is resistant to attempts by outside parties to alter the distribution of the random bits. Consistency means that a set of users can access the source in such a way that they are confident that they all receive the same random string.

The Beacon posts bit-strings in blocks of 512 bits every 60 seconds. Each such value is time-stamped and signed by NIST and includes the hash of the previous value to chain the sequence of values together. This prevents anyone, even the Beacon itself, from retroactively changing an output packet without being detected. The Beacon keeps all output packets and makes them available online at https://beacon.nist.gov/home.

Tables of random numbers have probably been used for multiple purposes at least since the Industrial Revolution. In the digital age, algorithmic random number generators have largely replaced those tables. The NIST Randomness Beacon expands the use of public randomness to multiple scenarios in which the latter methods cannot be used. The extra functionalities stem mainly from three features. First, the Beacon-generated numbers cannot be predicted before they are published. Second, the public, time-bound, and authenticated nature of the Beacon allows a user application to prove to anybody that it used truly random numbers not known before a certain point in time. Third, this proof can be presented offline and at any point in the future. For example, the proof could be mailed to a trusted third party, encrypted, and signed by an application, to be opened if needed and authorized.

Although commercially available physical sources of randomness are adequate as entropy sources for currently envisioned applications of the Beacon, NIST is working on developing a source of verifiably random sequences. Given that it is impossible to construct such sequences in any classical physical context, CSD is collaborating with the NIST Physical Measurement Laboratory (PML) to build a quantum source. The aim is to use quantum effects to generate sequences that are guaranteed to be unpredictable, even if an attacker has access to the random source. For more information on this collaboration, see http://www.nist.gov/pml/div684/random_numbers_bell_test.cfm.

As the bits posted by the Beacon are public, these are not to be used as secret values, such as cryptographic keys or seeds for random number generators used in the construction of cryptographic keys. NIST encourages the community-at-large to research and publish novel ways in which this tool can be used. Some examples of applications are unpredictable sampling, new authentication mechanisms, and secure multi-party computation. More details are available at http://beacon.nist.gov.

Dr. Michaela Iorga, (301) 975-8431, michaela.iorga@nist.gov

Dr. René Peralta, (301) 975-8702, rene.peralta@nist.gov

The privacy-enhancing cryptography project seeks to promote the use of communication protocols that do not unnecessarily reveal private information of communicating parties. There are many technical challenges in doing this, as it is typically hard to separate private data from general data (e.g., to convert a third-party-signed date-of-birth certificate into a certificate that a person is of voting age). Zero-knowledge (ZK) proof techniques and their variants can be used to accomplish this for a large class of assertions. These techniques allow one party to prove to another party that a given statement is true, without conveying any additional information apart from the fact that the statement is indeed true. Although many such ZK protocols are practical, adoption by industry is slow. CSD is following the progress of emerging technologies, such as fully homomorphic encryption (FHE). FHE could potentially solve a large class of problems, by allowing computation on encrypted data without decryption. CSD has also shown that the NIST Randomness Beacon (discussed in the previous section) can be used as a primitive in secure multi-party computation, such as sealed-bid online auctions in which losing bids are never opened.

Team members continue to be in close collaboration with the NSTIC program and the Federal Cloud Credential Exchange (FCCX) project. In this context, CTG has served as evaluators and in technical support roles. Information about NSTIC and FCCX is available at http://www.nist.gov/nstic/.

Current communication security standards are primarily designed for two-party communication. Future protocols, such as those for identification, commercial transactions, and social media, will necessitate standards for three-party communications (e.g., two parties involved in a commercial transaction and a third party that serves as an enabler of some aspects of the transaction). This is particularly important if standards are to provide privacy protection. NIST has developed some basic protocols for this purpose. One such protocol allows for privacy-preserving identification with the aid of a mediator. In this protocol, the issuer of an assertion, such as “John Smith is an employee of the Department of Commerce,” does not need to know who the consumer of the assertion is, yet it can encrypt the assertion with a key only known to that consumer (i.e., the mediator does not get to see the unencrypted assertion).

Dr. René Peralta, (301) 975-8702, rene.peralta@nist.gov

Pervasive computing is an emerging technical area in which many highly constrained devices (e.g., limited resources, such as program space and RAM) are interconnected, typically communicating wirelessly with one another, and working in concert to accomplish some task. These systems apply to a wide variety of fields. Sample application areas include sensor networks, medical devices, distributed control systems, and the Smart Grid. Security can be very important in each of these areas. For example, an unauthorized party should not be able to take control of an insulin pump or the brakes on a car. There are also privacy concerns, particularly in the area of Health IT.

Because the majority of the current cryptographic algorithms were designed for desktop/server environments, many of these algorithms cannot operate under these constraints, or if they can be made to operate in these constrained environments, their performance is typically not acceptable. A particular problem is the use of asymmetric (public key) algorithms. These algorithms tend to be much more computational and resource-intensive and are not easily accommodated in such constrained environments.

As a result, CSD is currently focusing on studying the use of the NIST-approved symmetric-key algorithms in constrained environments. Symmetric-key algorithms can perform encryption for confidentiality, and can generate message authentication codes (MAC) for authenticity and integrity. NIST has implemented the Advanced Encryption Standard (AES) to provide both confidentiality and the AES-based message authentication code, CMAC mode, for authentication. Additionally, CTG has implemented the 256-bit version of the Secure Hash Algorithm (SHA-256) to provide a Hash-based Message Authentication Code (HMAC) for authentication. The emerging Keccak algorithm has also been implemented – both the original 1600-bit permutation that won the hash competition (see the SHA-3 report above) and the reduced 800-bit permutation. It has been demonstrated that the Keccak algorithm allows a more efficient construction for computing MACs than SHA-256, which requires the HMAC construction. CTG has also investigated other, non-NIST-approved algorithms for constrained environments.

CTG will continue to analyze the resource requirements and performance characteristics of these algorithms, and study their use as building blocks to perform other cryptographic functions beyond encryption.

Mr. Lawrence Bassham, (301) 975-3292, lawrence.bassham@nist.gov

Stream ciphers are symmetric-key cryptographic primitives that encrypt plaintext bits individually using a time-varying transformation. The performance advantages of dedicated stream ciphers make them more attractive than block ciphers in stream-cipher-type modes (e.g., AES counter mode) for some niche software and hardware applications. In 2004, the European Network of Excellence for Cryptology (ECRYPT) announced the ECRYPT Stream Cipher (eSTREAM) project with the goal of identifying new stream ciphers that offer some performance advantages over AES. The eSTREAM portfolio, published in 2012, includes: 1) four algorithms for software applications: HC-128, Rabbit, Salsa20/12 and Sosemanuk, and 2) three algorithms for hardware applications: Grain, Trivium and Mickey.

The primary focus of the project is to study the eSTREAM candidates and other commonly used stream ciphers for possible standardization. During FY 2013, three internal talks were given: “Stream Ciphers for Constrained Environments,” “Authenticated Encryption In Stream Ciphers,” and “Stream Ciphers For Software Applications.” NIST researchers Meltem Sönmez Turan and Santanu Sarkar were two of the co-authors of “A Chosen IV Related Key Attack on Grain-128,” published at the 18th Australasian Conference on Information Security and Privacy, ACISP 2013. Dr. Turan also published “Related-Key Slide Attacks On Block Ciphers With Secret Components” at the Second International Lightweight Cryptography for Security and Privacy workshop, LightSec 2013.

After comparing the security and performance of stream ciphers to block ciphers designed for constrained environments, CTG observed that the gate array requirements for block and stream ciphers are comparable, but stream ciphers have a better throughput/area performance characteristic. CTG currently believes that well-designed lightweight block ciphers may be more suitable than stream ciphers for constrained environments. This determination is based upon the following factors: 1) the maturity of literature on block ciphers; 2) the availability of better tools to analyze the security of block ciphers; 3) reduced round attacks on the stream cipher finalists; and 4) lack of flexible key sizes for stream ciphers.

In FY 2014, NIST will continue to study the security and performance of software-oriented stream ciphers and block ciphers designed for constrained environments.

Dr. Lily Chen (301) 975-6974 lily.chen@nist.gov

Dr. Meltem Sönmez Turan (301) 975-4391 meltem.turan@nist.gov

Cryptographic primitives, such as encryption, digital signatures, and hashing, are implemented as electronic circuits for a wide class of applications. A variety of metrics is relevant to designing “good” circuits. In particular, minimizing the size and maximizing the throughput of a circuit closely translate into the combinatorial problem of designing circuits with few gates and short depth. The project team has shown that solving this design problem, even approximately, is “MAX-SNP Complete.” In practice, this means that it is necessary to settle for heuristics that design “good” circuits, as opposed to provably optimal circuits. It also means that many basic questions are likely to remain unanswered for the foreseeable future, even if quantum computers are ever built. For example, it is unlikely that the minimum number of gates necessary to implement the AES can be found. In the 12 years since the approval of AES, successive improvements have roughly cut the gate count in half. The standard reference for the smallest published circuit for AES is from a study funded by the National Security Agency. CTG improved on this work significantly by designing combinatorial circuits that are smaller (meaning that they are likely to use less energy) and others that are of lower depth (meaning that they are likely to be faster). The general technique was issued a patent held jointly between NIST and the University of Southern Denmark.

CTG is also researching circuit-based security metrics for cryptographic functions. For a function to be secure (one-way), it must be the case that any circuit that implements it is sufficiently complex. In particular, a function is insecure if it can be implemented by a circuit containing too few Boolean AND gates. This security metric, namely the number of AND gates necessary and sufficient to implement a function, is referred to as its multiplicative complexity. When comparing two cryptographic functions, all other things being equal, the one with higher multiplicative complexity is preferable. Unfortunately, determining multiplicative complexity is extremely hard. Mathematicians attempted this in the 1970s, but the effort had been largely abandoned by the 1980s. CTG has been able to compute tight bounds for the multiplicative complexity of an important class of functions (the symmetric functions). This theory seems to have wide applicability and it points to exciting directions for both theoretical and applied research in security and cryptography.

A partial list of results includes:

Dr. René Peralta, (301) 975-8702, rene.peralta@nist.gov

FIPS 140-2, Security Requirements for Cryptographic Modules, defines the security requirements for the cryptographic modules that perform cryptographic operations. This standard is applicable to all federal agencies that use cryptography-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems), as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106, and the Federal Information Security Management Act of 2002, Public Law 107-347. The standard must be used in designing and implementing cryptographic modules that federal departments and agencies operate, or that are operated for them under contract.

The current version of the standard is FIPS 140-2. Draft FIPS 140-3, a revision proposed to supersede FIPS 140-2, has been developed. The draft revision of the standard adds new security requirements for cryptographic modules to reflect the latest advances in technology and security and to mirror other new or updated standards published by NIST in the areas of cryptography and key management. Additionally, software and firmware requirements are addressed in a new topic area while another new area specifying requirements to protect against noninvasive attacks is also provided.

The standard provides four increasing, qualitative levels of security, intended to cover a wide range of potential applications and environments. The security requirements cover areas related to the secure design, implementation and operation of a cryptographic module. These areas include cryptographic module specification; cryptographic module physical ports and logical interfaces; roles, authentication, and services; software security; operating environment; physical security; physical security – non-invasive attacks; sensitive security parameter management; self-tests; life-cycle assurance; and mitigation of other attacks.

The draft of FIPS 140-3 has had two rounds of public review. The resolutions to the public comments received on the second draft of FIPS 140-3 include: 1) a description of the assumed threat models (e.g., attacker’s level of experience, expectations from the cryptographic module) for each of the four security levels; 2) an insertion of missing definitions for terms and acronyms; 3) changes to the Trusted Channel requirements; 4) the removal of the Trusted Role; 5) the inclusion of an identity-based authentication mechanism that would be allowed at Security Level (SL) 2; 6) the addition of a self-initiated cryptographic output capability and remote control capability; 7) the inclusion of additional integrity-technique requirements for the software components of a cryptographic module; 8) a restructure of the annexes and enhancement of the requirements for the allowed operator-authentication mechanisms; 9) an update of the list of the noninvasive attacks covered by the standard; and 10) an update of the requirements for the allowed modifiable operating environments.

During the process of addressing the public comments received on the second draft, CSD determined that additional feedback was required from the public to resolve gaps and inconsistencies among the comments received for particular sections of the second draft of FIPS 140-3. As a result, CSD requested additional public comments in August 2012 on several clearly identified sections.

During FY 2013, CSD discussed and addressed all comments received on the identified issues and prepared the updated draft FIPS 140-3 for a final internal review. The completion of the internal review and submission for approval by the Secretary of Commerce are expected in FY 2014.

http://csrc.nist.gov/groups/ST/FIPS140_3/

Dr. Michaela Iorga, (301) 975-8431, michaela.iorga@nist.gov

To support the Office of Management and Budget (OMB) Memorandum M-04-04, E-Authentication Guidance for Federal Agencies, NIST developed SP 800-63, Electronic Authentication Guideline. Its subsequent revision, SP 800-63-1 (published at the end of FY 2012) significantly expanded the range of included technologies, such as Security Assertion Markup Language (SAML) assertions. The OMB memorandum defines four levels of authentication in terms of assurance about the validity of an asserted identity. This recommendation covers remote authentication of users (such as employees, contractors, or private individuals) interacting with government IT systems over open networks. It defines technical requirements for each of four levels of assurance in the areas of identity proofing, registration, tokens, management processes, authentication protocols and related assertions.

As more electronic service delivery systems that require authentication and identity management became available, large-scale enrollment and registration issues became a significant problem for agencies, particularly for health care. Enrollment and identity proofing result in much of the up-front cost to agencies of implementing online service delivery and can be a barrier to user adoption. SP 800-63-2, a revision with changes largely limited to identity proofing and credential issuance, was published at the end of FY 2013 and is available at http://csrc.nist.gov/publications/PubsSPs.html.

SP 800-63-2 is intended to facilitate more efficient and convenient user enrollment and identity proofing, mainly by exploiting the identity proofing already done for professional licensing, registration, or certification (e.g., for doctors, nurses, lawyers, professional engineers). SP 800-63-2 also reduces the number of cases where postal mailings are required to confirm addresses, saving expense and making registration easier and more immediate for users.

In FY 2014, NIST expects its authentication work to be driven by the needs of the ongoing rapid expansion of online service delivery, as experience accumulates and technology progresses. Efforts to develop accreditation programs for e-authentication have revealed problem areas in the text of the specifications, while the rapidly growing and evolving use of mobile devices with Internet access and new capabilities present both challenges and opportunities. Practical business models for large-scale registration and credential issuance seem to indicate that separate organizations should do both, and NIST has been urged to make a clearer delineation of these activities in a future revision of SP 800-63. Unattended biometric authentication is considered problematic for remote authentication in SP 800-63-2, but the relatively high quality and online video/audio capabilities of the current mobile devices, as well as the fingerprint readers in some mobile phones, all deserve fresh consideration. Level 4 identity proofing currently requires an in-person appearance, which is often both expensive for agencies and inconvenient and time consuming for registrants, particularly in rural or remote areas. A comment received during the public review of SP 800-63-2 urged allowing the use of secure kiosks with high-quality video, document scanners and biometric readers that would be linked to a human registration operator in a registration center, as a viable solution. While this was judged to be too complex to evaluate in the schedule for SP 800-63-2, the idea is intriguing and deserves a detailed consideration.

NIST, therefore, plans to actively consider another incremental revision to SP 800-63-2 in response to the issues noted above and other issues that can be dealt with in time to assist in the intense ongoing efforts to expand online services.

Dr. Lily Chen, (301) 975-6974, lily.chen@nist.gov

Today, wireless networks often provide connections for mobile devices using multiple and different radio technologies. In such a heterogeneous network, a mobile device may switch its between different wireless technologies. The procedure of conducting such a switch is called a “handover.” Inter-technology handover has brought many challenges to existing security solutions, such as the delays caused by access authentication for each handover. CSD has conducted intensive research in the security for media-independent handover (MIH) and has worked closely with the working group of IEEE 802.21 on security solutions for MIH services. The services specified in IEEE 802.21 include information service, event service, and command service. The security mechanisms were developed by Task Group A of IEEE 802.21 and specified in Amendment 2 of IEEE 802.21, which provide MIH message protection and accommodate proactive authentications.

However, the protection mechanisms specified in Amendment 2 of IEEE 802.21 are only applied to unicast messages; that is, the mechanisms protect messages between a point of service (PoS) and a mobile node. When the services provided by the pervasive heterogeneous networks are extended to other applications, such as Smart Grid applications, the MIH needs to be processed for a group of wireless nodes, such as smart meters, for the reliability of the services. For example, the information may need to be delivered to a group of smart meters. In this case, the multicast message is used to deliver the information. That is, the message is sent from one PoS to multiple wireless nodes. In some of the application environments, such as sensor networks, the groups are formed dynamically. That is, new nodes can be added to the group, and some nodes may need to be removed. Such groups are managed through multicast signals. The protection for multicast messages and group management signals becomes critical. In FY 2013, CSD has worked with IEEE 802.21 to develop security solutions for group management in Task Group D of IEEE 802.21. The solutions include the mechanisms to distribute group keys and for the protection of multicast messages. In FY 2014, CSD will continue to contribute to the development of the IEEE 802.21 Amendment on group management.

Dr. Lily Chen, (301) 975-6974, lily.chen@nist.gov

Figure 8: Personal Identity Verification (PIV) and FIPS 201 Revision Efforts

In response to Homeland Security Presidential Directive-12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors, Federal Information Processing Standard (FIPS) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, was developed and was approved by the Secretary of Commerce in February 2005. HSPD-12 called for the creation of a new identity credential for federal employees and contractors. FIPS 201 is the technical specification for both the PIV identity credential and the PIV system that produces, manages, and uses the credential. Within NIST’s Information Technology Laboratory (ITL), this work is a collaborative effort of the Information Access Division (IAD) and CSD. CSD activities in FY 2013 directly supported the revision and maintenance of the FIPS 201 standard. CSD performed the following activities during FY 2013 to revise the standard:

In FY 2014, CSD will be focusing on updating the relevant publications associated with FIPS 201-2, including developing a new publication, SP 800-156, Representation of PIV Chain-of-Trust for Import and Export. CSD will also continue to provide technical and strategic inputs to the PIV related initiatives.

http://csrc.nist.gov/groups/SNS/piv/

Ms. Hildegard Ferraiolo, (301) 975-6972, hildegard.ferraiolo@nist.gov

Mr. Salvatore Francomacaro, (301) 975 6414, salvatore.francomacaro@nist.gov

Dr. David Cooper, (301) 975-3194, david.cooper@nist.gov

Mr. Ketan Mehta, (301) 975-8405, ketan.mehta@nist.gov

To facilitate the development of applications and middleware that support the PIV card, CSD developed a set of smart cards for testing. The initial work of developing the test cards was performed during FY 2011 and was completed during FY 2012. In late FY 2012, NIST began selling the test cards as NIST Special Database 33 (http://csrc.nist.gov/groups/SNS/piv/testcards.html).

Over the course of FY 2013, additional sets of test cards were created as the existing inventory of cards were sold. In addition, CSD has maintained a mailing list that has been used by individuals who have purchased the test cards to ask questions about the cards and to exchange advice on their use.

For further details on the PIV project, see the Personal Identity Verification (PIV) and FIPS 201 Revision Efforts section.

http://csrc.nist.gov/groups/SNS/piv/testcards.html

Figure 9: PIV Test Card

Dr. David Cooper, (301) 975-3194, david.cooper@nist.gov

The objective of the NIST Personal Identity Verification Program (NPIVP) is to validate PIV components for conformance to specifications in FIPS 201 and its companion documents. The two PIV components that come under the scope of NPIVP are PIV Smart Card Application and PIV Middleware. All of the tests under NPIVP are handled by third-party laboratories that are accredited as Cryptographic and Security Testing (CST) Laboratories by the NIST NVLAP and are called accredited NPIVP test facilities. As of September 2013, there were nine such facilities.

In prior years, CSD published SP 800-85A, PIV Card Application and Middleware Interface Test Guidelines, to facilitate development of PIV Smart Card Application and PIV Middleware that conform to interface specifications in SP 800-73, Interfaces for Personal Identity Verification. CSD also developed an integrated toolkit called “PIV Interface Test Runner” for conducting tests on both PIV Card Application and PIV Middleware products, and provided the toolkit to accredited NPIVP test facilities.

NPIVP validation utilized the following versions and documents throughout FY 2013:

In FY 2013, two new PIV card application products were validated for conformance to SP 800-73-3 and received certificates, bringing the total number of NPIVP validated PIV Card application products to 36. Three PIV Middleware products were validated for conformance to SP 800-73-3 and received certificates, for a total number of 20 NPIVP-validated PIV Middleware products.

In addition, NPIVP is closely involved in ensuring that all changes in PIV companion documents, such as SP 800-73-3, SP 800-76-2, and SP 800-78-3, are fully reflected in the conformance test document SP 800-85A-2 as well as subsequently in the PIV Test Runner toolkit consequent on the expected publication of FIPS 201-2.

http://csrc.nist.gov/groups/SNS/piv/npivp

Dr. Ramaswamy Chandramouli, (301) 975-5013, mouli@nist.gov

Ms. Hildegard Ferraiolo, (301) 975-6972, hildegard.ferraiolo@nist.gov

Cloud computing is a model defined in the NIST SP 800-145, The NIST Definition of Cloud Computing. The foundational technologies that facilitate the use of a computing infrastructure for cloud computing services is virtualization. At the core of a virtualized infrastructure is the virtualized host that provides abstraction of the hardware (e.g., CPU, memory) enabling multiple computing stacks (comprised of the operating system, middleware, and applications) to be run on a single physical machine. The efficiency of such a dynamic and distributed processing environment is counter-balanced by the interoperability, portability, and security challenges inherent to this computing environment. NIST is working in parallel on several projects introduced below that aim to accelerate the Federal Government’s secure adoption of cloud computing by collaborating with standards bodies, public and private sector in developing security, interoperability and portability standards and guidance.

During FY 2013, the NIST Cloud Computing Team continued to promote the development of publications, national and international standards, and specifications in support of the USG’s effective and secure use of cloud computing as well as providing technical guidance to USG agencies for secure and effective cloud computing adoption.. CSD supports many of the technical standards activities supported by the NIST Cloud Computing Program, with a particular focus on cloud computing security.

Figure 10: NIST Security Reference Architecture Diagram

CSD staff members contributed significantly to several NIST-hosted events:

In support of and advancement of USG cloud computing mandates, CSD staff members provided leadership for several public work groups operating under the NIST Cloud Computing Program. Through these working groups, CSD staff led the development of technical guidelines and recommendations that considered a close collaboration with public, private, academia and other stakeholders.

CSD staff chaired or co-chaired several significant cloud computing efforts in 2013:

CSD staff members participate in various standards development organizations, two of which are ISO/IEC JTC 1 Sub Committee 38 – Distributed Application Platforms and Services (SC 38) and ISO/IEC JTC 1 Sub Committee 27 – IT Security Techniques (SC 27). In SC 38, CSD acts as the co-convener for a collaborative ISO/ITU-T initiative on cloud computing taxonomy that includes work on ISO/IEC 17788 – Information Technology – Cloud computing – Overview and Vocabulary. Notably, the genesis for this international body of work is the widely accepted and used cloud computing definition found in SP 800-145, NIST Definition of Cloud Computing.

ISO/IEC 17788 is closely coordinated with another standards activity, ISO/IEC 17789 – Information technology – Cloud Computing – Reference Architecture, which is based on the widely used and accepted NIST publication, SP 500-292. Both ISO/IEC 17788 and 17789 are in the final stages of international balloting before final publication, which is anticipated in the first quarter of calendar year 2014.

CSD staff members are also actively participating in cloud computing security standards, primarily through SC 27, which is responsible for cloud computing security standards. CSD has provided technical contributions based on SP 500-299 and continues to advocate for secure, non-proprietary solutions.

In FY 2013, the CSD members of the NIST cloud computing team also presented the results of cloud computing research and development, introduced the standards and specifications under development, and provided status of the NIST Cloud Computing Program in a variety of conferences and workshops.

Figure 11: Policy Machine operating environment

In FY 2013, CSD continued the research and development of a virtualization-based, enterprise-wide controlled delivery of data services for advanced cloud computing through Access Control. NIST and other members of an Ad Hoc INCITS working group are developing a three-part PM standard, under the title of “Next Generation Access Control” (NGAC), under three sub-projects:

The Policy Machine’s architecture has been adopted by the ANSI/INCITS and is now available as ANSI INCITS 499 – Information technology – Next Generation Access Control – Functional Architecture (NGAC–FA).

Many of the security capabilities associated with exercise of cloud service rely on cryptographic operations. The key management system (KMS) required to support cryptographic operations for the above tasks can be complex, due to differences in ownership and control of underlying infrastructures on which the KMS and the protected resources are located. CSD developed NISTIR 7956, Cryptographic Key Management Issues & Challenges in Cloud Services to discuss these critical issues.

CSD has been researching key areas in cloud and virtualization security producing the following papers:

“Security Assurance Requirements for Hypervisor Deployment Feature” published as part of the proceedings of the 7th International Conference on Digital Society. In FY 2014, CSD will consider feedback from public comments received and publish a (yet unnumbered) Special Publication titled Secure Management Practices for Protection of Hypervisors. In addition, security assurance requirements and security recommendations will be developed for components of virtualized infrastructure other than the hypervisor, such as the guest O/S, VM-based applications, and the virtual network..

Additional information about the NIST Cloud Computing Program is available at:

http://www.nist.gov/itl/cloud

http://collaborate.nist.gov/twiki-cloud-computing/bin/view/CloudComputing/StandardsRoadmap

http://collaborate.nist.gov/twiki-cloud-computing/bin/view/CloudComputing/CloudSecurity

http://collaborate.nist.gov/twiki-cloud-computing/bin/view/CloudComputing/CloudForensics

Dr. Michaela Iorga, Chair, Cloud Computing Security Workgroup, (301) 975-8431, michaela.iorga@nist.gov

Ms. Annie Sokol, Co-Chair, Cloud Computing Standards Roadmap, (301) 975-2006, annie.sokol@nist.gov

Mr. Daniel Benigni, Chair, INCITS CS1 (Cybersecurity) - US Technical Advisory Group (TAG) to the ISO/IEC international committee JTC1/SC27 (IT Security Techniques), (301) 975-3279, dbenigni@nist.gov

Mr. Salvatore Francomacaro, Vice-Chair, INCITS CS1 (Cybersecurity) - US Technical Advisory Group (TAG) to the ISO/IEC international committee JTC1/SC27 (IT Security Techniques), (301) 975-6414, salvatore.francomacaro@nist.gov

Mr. David Ferraiolo, (301) 975-3046, david.ferraiolo@nist.gov

Mr. Serban Gavrila, (301) 975-4242, serban.gavrila@nist.gov

Dr. Ramaswamy Chandramouli, (301) 975-5013, mouli@nist.gov

Dr. Michaela Iorga, (301) 975-8431, michaela.iorga@nist.gov

Dr. Ramaswamy Chandramouli, (301) 975-5013, mouli@nist.gov

Smart phones have become both ubiquitous and indispensable for consumers and business people alike. Although these devices are relatively small and inexpensive, they can be used for voice calls, simple text messages, sending and receiving emails, browsing the web, online banking and ecommerce, social networking, and many functions once limited to laptop and desktop computers. Smart phones and tablet devices have specialized built-in hardware, such as photographic cameras, video cameras, accelerometers, Global Positioning System (GPS) receivers, and removable media readers. They also employ a wide range of wireless interfaces, including infrared, Wireless Fidelity (Wi-Fi), Bluetooth, Near Field Communications (NFC), and one or more types of cellular interfaces that provide network connectivity across the globe. Naturally, just as consumers and business people can realize productivity gains from these technologies, so can government agencies.

Like any new technology, smart phones present new capabilities, but also a number of new security and privacy challenges. As the pace of the technology life cycles continues to increase, current Information Assurance (IA) standards and processes must be updated and new technologies to allow government users to employ the latest technologies that consumers can use without sacrificing privacy and security.

NIST is conducting research in new software assurance methodologies for smart phone software (i.e., apps) and is working with industry to bridge the security gaps present with today’s smart phones. NIST has developed an online beta Application Testing Portal (ATP) for Android that examines app functionality with respect to agency security and privacy guidelines. NIST is working closely with the Defense Advanced Research Projects Agency (DARPA) to transition this software assurance technology to other agencies and making the ATP software available to industry as open source.

Building on this expertise in mobile app software assurance, NIST researchers are developing platform-independent techniques for identifying mobile malware by analyzing mobile app network behavior. NIST researchers are also developing metrics for evaluating the effectiveness of mobile app security test tools.

Dr. Steve Quirolgico, (301) 975-8426, stephen.quirolgico@nist.gov

Dr. Jeffrey Voas, (301) 975-6622, jeff.voas@nist.gov

Dr. Tom Karygiannis, (301) 975-4728, karygiannis@nist.gov

Internet Protocol (IP) Version 6 (IPv6) is an updated version of the current Internet Protocol, IPv4. The primary motivations for the development of IPv6 were to increase the number of unique IP addresses available for use and to handle the needs of new Internet applications and devices. In addition, IPv6 was designed with the following goals: increased ease of network management and configuration; expandable IP headers; improved mobility and security; and quality of service controls. IPv6 has been, and continues to be, developed and defined by the Internet Engineering Task Force (IETF).

FY 2012 was a significant year for the deployment of IPv6 in the United States Government. OMB’s Memo of September 10, 2010, Transition to IPv6, required all government agencies to “upgrade public/external facing servers and services (e.g., web, email, Domain Name System (DNS), Internet Service Provider (ISP) services) to operationally use native IPv6 by the end of FY 2012.” NIST worked with the USGv6 Task Force and with individual government agencies to achieve this goal. NIST developed an online monitor to demonstrate which high-level government domains have met this goal with respect to DNS services, email, web servers, and Domain Name System Security Extensions (DNSSEC). In FY 2013, NIST and OMB continued to use this monitor to measure USGv6 compliance with OMB’s requirement.

FY 2014 will bring additional OMB IPv6 requirements. Agencies will “upgrade internal client applications that communicate with public Internet servers and supporting enterprise networks to operationally use native IPv6 by the end of FY 2014.” NIST is developing online diagnostic tools to help agencies verify compliance to this requirement.

The NIST IPv6 Test Program, whose goal is to provide assurance on IPv6 product conformance and interoperability, continues to operate. In FY 2014, NIST will continue to manage and evolve the USGv6 Test Program. The NIST program is a collaboration between CSD and the Advanced Networking Technology Division.

http://www.antd.nist.gov/usgv6

Ms. Sheila Frankel, (301) 975-3297, sheila.frankel@nist.gov

Mr. Douglas Montgomery, (301) 975-3630, dougm@nist.gov

With the advance of current computing technologies and the diverse environments in which these technologies are used, security issues, such as situational awareness, trust management, preservation of privacy in access control, and privilege management systems, are becoming increasingly complex. Practical and conceptual guidance for these topics is needed.

In FY 2013, the following research was accomplished for this project: 1) unified enforcement mechanism of data services for use by a Policy Machine (PM) for enterprise computing environment, 2) enhanced the capabilities of the Access Control Policy Tool (ACPT), 3) researched a new fault-detection method for access control rule using Simulated Logic Circuit algorithms, 4) researched formal ABAC models, and completed the development of Special Publication 800-162, Guide to Attribute Based Access Control (ABAC) Definition and Considerations, which provides information of function components as well as enterprise consideration of ABAC.

CSD expects that this project will:

Figure 12: Access Control and Privilege Management

Dr. Vincent Hu, (301) 975-4975, vhu@nist.gov

Mr. David Ferraiolo, (301) 975-3046, david.ferraiolo@nist.gov

Mr. Rick Kuhn, (301) 975-3337, kuhn@nist.gov

Access control systems are among the most critical network security components. Faulty policies, misconfigurations, or flaws in software implementation can result in serious vulnerabilities. The specification of access control policies is often a challenging problem. Often a system’s privacy and security are compromised due to the misconfiguration of access control policies instead of the failure of cryptographic primitives or protocols. This problem becomes increasingly severe as software systems become more and more complex and are deployed to manage a large amount of sensitive information and resources organized into sophisticated structures. Identifying discrepancies between policy specifications and their properties (intended function) is crucial because correct implementation and enforcement of policies by applications is based on the premise that the policy specifications are correct. As a result, policy specifications must undergo rigorous verification and validation through systematic testing to ensure that the policy specifications truly encapsulate the desires of the policy authors.

To formally and precisely capture the security properties that access control should adhere to, access control models are usually written to bridge the rather wide gap in abstraction between policy and mechanism. Thus, an access control model provides unambiguous and precise expression as well as reference for design and implementation of security requirements. Techniques are required for verifying whether an access control model is correctly expressed in the access controls policies and whether the properties are satisfied in the model. In practice, the same access control policies may express multiple access control models or express a single model in addition to extra access control constraints outside of the model. Ensuring the conformance of access control models and policies is a nontrivial and critical task.

Started in 2009, CSD developed a prototype system, Access Control Policy Tool (ACPT), which allows a user to compose, verify, test, and generate access control policies.

In FY 2013, ACPT was downloaded by 190 users and organizations. CSD performed prototype testing, enhanced the capability of ACPT by adding privilege inheritance algorithms, applied user cases of Attribute Based, Multi-Level, and Workflow access control models to test ACPT’s performance, and compared to other formal method for performance and usability. CSD also produced a new user manual that explains new capabilities of ACPT. In addition, CSD published a research paper related to ACPT.

In FY 2014, CSD will continue testing, enhance the capability of ACPT by applying the tool for more complex access control policy combinations, provide model profiles, and improve user interfaces. CSD will also update ACPT based on user feedback and suggestions.

Figure 13: Conformance Verification

This project is expected to: