NIST SP 800-206 日本語訳

Computer Security Division

Applied Cybersecurity Division

Information Technology Laboratory

Information Technology Laboratory

Larry Feldman
Greg Witte
G2, Incorporated (“G2”)
a Huntington Ingalls Company
Annapolis Junction, Maryland

https://doi.org/10.6028/NIST.SP.800-206

U.S. DEPARTMENT OF COMMERCE Wilbur L. Ross, Jr., Secretary

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Institute of Standards and Technology Special Publication 800-206 Natl. Inst. Stand. Technol. Spec. Publ. 800-206, 31 pages (January 2020)

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-206

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Any mention of commercial products or organizations is for informational purposes only; it is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the products identified are necessarily the best available for the purpose.

All names are trademarks or registered trademarks of their respective owners.

“The more things change, the more they stay the same.” (From a French proverb)

Ten years ago, the National Institute of Standards and Technology (NIST) annual report on cybersecurity featured accomplishments and challenges in quantum computing, encryption, identity management, personal identity verification, vulnerability measurements, assessing the security controls in federal information systems, mobile devices, international standardization, and addressing the needs of small and medium-sized businesses, all of which were among the many pressing topics of the day. Sound familiar?

Reviewing those topics in the NIST Fiscal Year 2008 report on computer security activities and accomplishments might lead some to conclude that the old French proverb is true when it comes to cybersecurity. But in this case, a more appropriate statement might be, “The more things appear to stay the same, the more quickly they actually change.”

That certainly is true for the threat environment in which we function today. New attack surfaces, new vulnerabilities, and new attackers emerge constantly. The creativity, the dramatically increased frequency of attacks, and the ready availability of new technologically enhanced modes of attack are even more difficult to identify—much less protect, detect, respond to, and recover from—before they inflict great harm to U.S. organizations and our economy, security, and society in general.

A decade later, these changes have enormous implications in a world that is so much more dependent on digital devices, systems, and connectivity for carrying out both the specialized and ordinary activities that drive our economy and safeguard our security. They create thorny challenges as we seek balance in battling attacks and attackers while preserving our intellectual property, privacy, civil rights, and liberties.

The speed with which our cybersecurity risks change means that everyone involved in managing those risks needs to pick up the pace. That is what NIST is doing with the help of many partners and through varied programs and approaches.

In Fiscal Year 2018, we received and worked on new cybersecurity-related assignments from Congress and the President. Those have led us to focus our attention on assisting small businesses, forging practical solutions to address security concerns raised by the Internet of Things, and updating our guidance on risk management and security controls for federal agencies and others. We also launched major new initiatives, including the development of a voluntary framework for privacy risk management, standards for post-quantum cryptography, and revisions to Federal Information Processing Standard (FIPS) 140-3,¹ Security Requirements for Cryptographic Modules.

One thing has remained constant over the past decade: our commitment to cultivating trust in information and the technology that drives the development and handling of that information. This annual report focuses on some of NIST’s most noteworthy cybersecurity achievements in 2018 and offers insights into our current priorities and strategies. For a more complete review of our work, check out our primary cybersecurity website.²

NIST welcomes all suggestions for how we can improve our cybersecurity work to better serve the public and private sectors. And, by all means, please join us as we pick up the pace.

Donna F. Dodson NIST Chief Cybersecurity Advisor

It is often said that cybersecurity is about people, process, and technology. That’s a convenient way to think about cybersecurity challenges, and it is the primary approach that the National Institute of Standards and Technology (NIST) takes in carrying out its cybersecurity mission. This report highlights NIST’s Fiscal Year (FY) 2018 cybersecurity-related accomplishments and includes many examples of how the NIST Information Technology Laboratory (ITL) delivers value to the nation by focusing on each element of the people, process, and technology triad. Importantly, NIST strives to address those three areas in an integrated fashion, knowing that siloed thinking about cybersecurity is not a viable path to success.

NIST carries out its cybersecurity responsibilities through an open, transparent, and inclusive approach, teaming with organizations in the private sector, non-profit sphere, academia, and government at multiple levels. It does so by cooperating with partners in the United States and abroad who contribute to the research, development, standards, and applications that are all needed to advance both the state-of-the-art and the state-of-practice when it comes to cybersecurity. NIST is also assisted in identifying emerging managerial, technical, administrative, and physical safeguard issues by the Information Security and Privacy Advisory Board (ISPAB).³ ISPAB is the Federal Advisory Committee⁴ that advises NIST, the Secretaries of Commerce and Homeland Security, and the Office of Management and Budget on security and privacy matters.

All of NIST’s cybersecurity work is conducted in an environment that demands technical excellence and integrity and that aims to cultivate trust in technologies and institutions. NIST’s portfolio of cybersecurity programs works along the full spectrum of cybersecurity challenges and potential, from foundational research to applied engineering and transition to practice.

NIST knows that improving all aspects of cybersecurity is an imperative, not just for the agency but for all of society that relies on technologies, products, and systems. NIST’s FY18 premier cybersecurity accomplishments and brief insights into FY19 priorities are captured in the cybersecurity imperatives that follow.

INTRODUCTION

NIST’s research, standards, guidelines, and recommended best practices are aimed at improving the effectiveness of cybersecurity strategies and measures. They offer an expanding and up-to-date toolkit that information technology (IT) and operational technology (OT) providers and users can put to work to justifiably enhance trust in IT and related technologies. Historically, much of NIST’s outputs have been developed primarily for government agencies that are directed by statute and policy to use the Institute’s cybersecurity standards and guidelines. However, they also are widely and voluntarily relied upon by private sector cybersecurity practitioners, product vendors and integrators, state and local agencies, and others who see value in NIST’s information and services.

NIST recognizes that many systems owners and administrators often find it difficult to sort through the voluminous output of NIST cybersecurity guidance to identify standards and guidelines that apply to their areas of interest. They may struggle to understand how these resources apply to their environments and how NIST’s cybersecurity products can be used to address their requirements. They may have difficulty with usability implications of integrating cybersecurity into their systems. These current and potential users need assistance in finding the kind of applications support that NIST offers in addressing some specific cybersecurity implementation problems. In FY18, NIST increased its attention to issues associated with transition to practice with an eye on accelerating adoption of cybersecurity standards, guidelines, and best practices. NIST is ramping up that priority even more steeply in 2019, often through the National Cybersecurity Center of Excellence (NCCoE) as well as throughout the Information Technology Laboratory (ITL). This report spotlights some of those initiatives.

NIST leverages foundational and applied research as well as extensive experience acquired through decades of leadership and participation in developing national and international standards to advance cybersecurity and privacy standards. Today, these standards activities span cybersecurity, privacy, and cryptography, as well as newer and emerging technology spaces such as Artificial Intelligence and the Internet of Things.

About 40 NIST staff work with industry and other agencies to develop cybersecurity and privacy standards through voluntary consensus Standards Developing Organizations (SDOs). The NIST Cybersecurity Framework (CSF) has provided additional focus and a systematic approach to standards work in this space. This international standards strategy follows the guidelines defined in NISTIR 8074, Cybersecurity Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity.

Figure 1. NIST staff participation in cybersecurity standards activities

IMPERATIVE 1 — Advancing Cybersecurity and Privacy Standards

During FY18, NIST staff actively contributed to and held leadership positions in various SDOs, including the American National Standards Institute (ANSI), the International Organization for Standardization (ISO), the International Electrotechnical Commission (IEC), the Institute of Electrical and Electronics Engineers (IEEE), the Internet Engineering Task Force (IETF), the T Trusted Computing Group (TCG), the World Wide Web Consortium (W3C), and the 3rd Generation Partnership Project (3GPP). Many of the international SDOs have domestic counterparts. Figure 1, on the previous page; indicates the SDOs in which NIST is actively engaged.

NIST staff have been actively participating in ISO standards bodies to raise awareness and influence the development of privacy standards, including a new family of ISO standards (developed primarily in ISO/IEC Joint Technical Committee (JTC 1)/ Subcommittee (SC) 27) that is aligned with the principles of the NIST Cybersecurity Framework. Notably, NIST staff participates in the Technical Committee ISO/Program Committee (PC) 317 – Consumer Protection: Privacy by Design for Consumer Goods and Services, which focuses on developing ISO 31700 Consumer protection: Privacy by Design for Consumer Goods and Services. NIST staff has also been engaged with several privacy standards activities of the ITC 1/SC 27/Working Group (WG) 5. By participating, NIST aims to sustain and promote the development and use of the NIST Privacy Framework and its principles in the international arena.

NIST participation has also grown considerably in Internet of Things (IoT) standardization activities, including JTC 1/SC 41 (IoT architecture and vocabulary, IoT Interoperability, and IoT Applications), JTC 1/SC 27 (IoT aspects of Security and Privacy), IETF – SW Updates for IoT, and the International Telecommunications Union–Telecommunication Standardization Sector (ITU-T): Sector Joint Coordination Activity on IoT and “IoT and Smart Cities.” NIST has been instrumental in promoting and participating in the development of a family of voluntary ISO standards that align with NIST’s cryptographic module validation standard and related specifications. NIST serves as the project editor for nine of those standards. FIPS 140-3, Security Requirements for Cryptographic Modules, points to ISO/IEC 19790, Security Requirements for Cryptographic Modules. Testing for these requirements will be performed in accordance with ISO/IEC 24759, Test Requirements for Cryptographic Modules. This is an ongoing effort and will continue over the next several years to support a smooth transition path to those using FIPS 140-3 specifications.

In FY19, NIST staff will continue to lead and participate in cybersecurity and privacy standardization efforts with an increased focus on cybersecurity, privacy, and cryptography, as well as on new and emerging areas such as Artificial Intelligence and the Internet of Things. NIST will continue to provide thoughtful leadership in many SDOs by actively participating in those organizations and contributing publications and papers.

Increasingly, NIST’s work is driven by a recognition that risk management should be a fundamental driver for every organization’s decisions about investments in cybersecurity—whether those investments take shape as people, processes, or technology. NIST considers managing risk to be an essential principle and process for organizations of any size or type to employ in planning and carrying out their cybersecurity programs and in making decisions about priorities.

During FY18, NIST made significant strides in producing cybersecurity risk management approaches and tools and assisting organizations in their use. Most notably, these achievements included:

Recognizing and seeking to further stimulate international usage of the Cybersecurity Framework, NIST worked on a Spanish language translation, which is now available along with translations or adaptations provided by government agencies and industry leaders in Italian, Japanese, Hebrew, Arabic, and Portuguese. NIST also engaged more purposefully to promote the alignment and use of the Framework, especially in Latin America and Europe. In the international standards arena, NIST vigorously assisted in efforts to include the Framework into a key International Organization for Standardization (ISO) cybersecurity standard, a process that is still under way.

In addition, NIST included many more resources to aid in using the Cybersecurity Framework, many of which were generated by private sector, non-profit, and government organizations. NIST also launched a series of “Success Stories” highlighting the variety of ways in which organizations of all types and in all sectors are finding value in the Framework. Also in FY18, NIST recognized that new information products and tools are regularly being produced well beyond the initial Informative References included in Version 1.0 and pushed forward with an initiative that establishes a transparent, equitable process for organizations to propose new references, which are intended to be included as online Informative References associated with the Framework.

The revised RMF also offers additional guidance on:

Importantly, the revised RMF clarifies its relationship to the Cybersecurity Framework. Aligning the RMF with other NIST guidance and publications will help federal agencies which are required to implement multiple frameworks. While adhering to the CSF is voluntary for private companies, its use for the federal government is not optional under Executive Order 13800.⁸ Use of the RMF is mandatory for federal agencies in accordance with the Federal Information Security Modernization Act (FISMA⁹). The RMF is also required and in widespread use in the Department of Defense and the intelligence community. That alignment of the Cybersecurity Framework and the RMF is still a work in progress with NIST committed to producing improved guidance in 2019.

Other risk management-focused NIST cybersecurity accomplishments in FY18 included an update of NIST’s recommendations for protecting the confidentiality of controlled, unclassified information (CUI) in non-federal systems and organizations. Safeguarding that CUI is of paramount importance and can directly affect the ability of federal agencies to successfully conduct their assigned missions and business operations. NIST SP 800-171 Revision 1¹⁰ recommends security requirements to those agencies. The FY18 update included editorial changes to select CUI security requirements, additional references and definitions, and an expanded discussion about each CUI requirement.

Cryptography—the technological foundation for most cybersecurity functions— is constantly under attack by a multiplying array of adversaries that range from individual criminals seeking financial gains to terrorist groups and nation states. If the cryptographic protection for an organization’s information technology is defeated or bypassed, the organization—and, potentially, our nation’s entire infrastructure system— may be wide open to malicious attack.

NIST is responsible for developing U.S. federal cryptographic standards as well as the technologies and programs used to determine and validate correct implementation of those standards. This has been a mainstay of NIST’s computer security work for nearly 50 years. In FY18, NIST continued to work with partners in government, the private sector, and academia in the United States and around the globe to confront a variety of urgent technical and implementation challenges to cryptographic security. These included:

After an earlier call to the public to submit post-quantum algorithms¹¹ that could resist a quantum computer’s onslaught, from FY18 to FY19 NIST worked with the larger cryptography community to narrow the field from 69 submitted algorithms to 26. The remaining algorithms are those which NIST mathematicians and computer scientists consider to be the strongest candidates. Next, NIST is asking the cryptography community to focus on analyzing how these algorithms will perform in the real world (e.g., how they will fit into the internet protocols currently in use). This second round of analysis focuses more heavily on evaluating the submissions’ performance across a wide variety of systems, not just in big computers and smartphones.

In FY19, NIST will begin revising additional guidance, convene¹⁷ a stakeholder workshop on threshold cryptography, complete development¹⁸ of a hardware chip that implements improved techniques, and continue to work with external collaborators on developing consensus-based blockchain standards.

In FY18, NIST released a study¹⁹ that estimated a $250 billion economic impact from the development of its Advanced Encryption Standard (AES) from 1996-2017. AES is a cryptographic algorithm²⁰ to encrypt and decrypt electronic information. It was approved for use by the Federal Government in November 2001 and has since been widely adopted by private industry. Today, AES protects everything from classified data and bank transactions to online shopping and social media apps. According to the study, NIST’s investment in AES has been repaid many times over—the study’s most conservative estimate shows a 29 to 1 benefit-to-cost ratio for the AES program. The estimated benefit-to-cost ratio for the whole economy was 1,976 to 1. The report relied on a survey of government and private sector consumers of encryption systems and private integrators who develop and produce encryption hardware or software.

In 1997, NIST launched its effort to identify a new standard encryption algorithm for the Federal Government after recognizing that the Data Encryption Standard (DES), adopted 20 years earlier, was growing vulnerable in the face of advances in cryptanalysis and the exponential growth in computing power. In October 2000, following a three year, open international competition, NIST announced its proposal for the replacement standard: an algorithm submitted by two cryptographers from Belgium. The unclassified, publicly disclosed encryption algorithm is available royalty-free and is used by the U.S. Federal Government in its Federal Information Processing Standard (FIPS) and voluntarily by private organizations worldwide.

Several years ago, NIST launched a project to automate much of the testing required under its cryptographic validation programs. Automated cryptographic algorithm testing was completed in 2018, and NIST is now developing methods to automate the testing of cryptographic modules. These efforts in automation are intended to provide a higher trust in the assurance claims made by the product developers in an efficient and cost-effective manner that allows the vendors’ conformance efforts to keep pace with the changing IT landscape. By investing in a more robust testing infrastructure, NIST anticipates that product vendors will take advantage of this service by validating their products more often, which will produce more secure products. In FY19, NIST will put more responsibility for generating evidence of conformance in the hands of industry by leveraging automated test processes that will reduce time to market, slice costs to maintain compliance, and ensure that the Federal Government has effective and up-to-date technologies.

Beyond cryptography-related priorities, NIST’s cybersecurity research and applications development activities include identifying emerging and high-priority technologies, developing security solutions that will have a high impact on the U.S. critical information infrastructure, and developing and showing how to manage foundational building-block security mechanisms and techniques that can be integrated into organizations’ mission-critical information systems. Accomplishments included:

able to receive sensor data from devices located 5 miles away from the receptor. Potential security weaknesses and possible mitigations arising out of this experience with LPWAN technology are now being investigated. Researchers have learned that WiFi and Bluetooth do not naturally apply to some IoT/CPS deployment scenarios, particularly when deployment is outside, requires battery operation for extended periods, or must operate over a long range. In FY18, the team also deployed an LPWAN Infrastructure that was integrated with NIST’s internal network, NIST-Net, satisfying all security policies required by NIST. In FY19, the NIST Engineering Laboratory (EL), NIST/ITL, and National Institute of Metrology, Standardization and Industrial Quality (INMETRO) team will study the implementation of LPWAN on the Smart Grid and investigate LPWAN in the context of Smart Grid cybersecurity guidelines.

People are often the most underappreciated ingredient in the people, process, and technology formula that determines an organization’s readiness to understand and deal with cybersecurity challenges. This includes gaps in users’ and providers’ awareness about how to access cybersecurity guidelines and tools that apply to their own operations and environments along with a shortage of people who have the needed cybersecurity education, training, and experience.

In FY18, NIST placed a greater emphasis on improving the public availability of information resources by providing them to small businesses in the form of briefings, advancing awareness and understanding of human factors contributing to cybersecurity challenges, and recommendations for steps to address workforce shortage and training issues.

FY18 web-accessible information resources included: the Computer Security Resource Center (CSRC),²⁹ National Software Reference Library (NSRL),³⁰ Security Automation Reference Data and the National Vulnerability Database (NVD),³¹ National Checklist Program (NCP) repository,³² Software Assurance and Quality Software Assurance Reference Dataset (SARD),³³ and Computer Forensics Tool Testing Project tool catalog³⁴ and reference data sets.³⁵ Ongoing federal outreach efforts include the Software and Supply Chain Assurance (SSCA) Forum,³⁶ the Federal Computer Security Managers’ (FCSM) Forum,³⁷ and the Federal Information Systems Security Educators’ Association (FISSEA).³⁸

together with interagency and industry partners and collaborators. The NIST Small Business Cybersecurity Act, which became law on August 14, 2018, codified the Institute’s focus on small businesses. Specifically, the statute directed NIST to “disseminate clear and concise resources to help small business concerns identify, assess, manage, and reduce their cybersecurity risks.” During FY18, the NIST Small Business Outreach Program began updating the Small Business Cybersecurity Corner website to make resources easier to find and use. In FY19, those training materials and accompanying resources will be expanded based on contributed cybersecurity resources and feedback received from federal partners and the public.

Figure 2: The Seven Categories of the NICE Framework

In FY18, fulfilling a directive in Executive Order 13800,40 NICE joined with the Department of Homeland Security to prepare a report to the President⁴¹ that made a series of recommendations. In their transmittal to the President, the Commerce and Homeland Security Secretaries noted that “in both the private and public sectors, cybersecurity practitioners and educators are vital to our national security—especially since other nations are paying greater attention to their cybersecurity workforce needs and the cybersecurity weaknesses of their adversaries.” The report was based on an analysis of available data and the information and views shared by businesses, educational organizations, training and certification providers, government agencies at multiple levels, and individuals. Findings and specific, forward-thinking, and actionable recommendations addressed both public and private sector needs (see Text Box #4). In FY19, the President issued another executive order⁴² directing agencies to implement those recommendations

In FY18, the NICE program worked to enhance CyberSeek.⁴⁵ This tool was developed in partnership with industry to help employers, job seekers, policy makers, training providers and guidance counselors find information on the supply of workers with relevant credentials and to show career pathways in cybersecurity that map opportunities for advancement in the field.

During FY18, the Usability and Cybersecurity team published a paper reporting the results of online surveys of organizations involved in cryptographic development. Findings revealed that organizations used cryptography for a wide range of purposes. Most relied on generally accepted, standards-based implementations as guides while others developed their own implementations by drawing from non-standards resources. The results highlighted the challenges for organizations that undertake cryptographic development, including difficulties in recruiting and managing talent, disruptions to the product lifecycle, and trouble explaining the security value of products to customers. Interviews of representatives from organizations that include cryptography in their products suggested a strong security mindset demonstrated by robust organizational security culture and the deep expertise of those performing cryptographic development. The results encourage additional research initiatives to explore variations in those implementing cryptography, which can aid in transferring lessons learned from more security-mature organizations to the broader development community through educational opportunities, tools, and other mechanisms.

Properly managing access to IT systems, processes, and information is central to managing cybersecurity risks and a priority for NIST’s cybersecurity program. NIST engages and collaborates with standards bodies and consortia such as the International Organization for Standardization (ISO),⁴⁶ the Internet Engineering Task Force (IETF),⁴⁷ the Fast IDentity Online (FIDO) Alliance,⁴⁸ the Open Identity Federation (OIF), and the Kantara Initiative.⁴⁹

In response to a widely recognized need, NIST continued to advance the challenge of moving away from passwords and plans to publish a key report in 2019 with its latest research findings and recommendations. In 2018, NIST:

In FY19, NIST intends to finalize SP 1800-3, SP 1800-13, and SP 1800-17 based on comments from industry and the public.

IMPERATIVE 6 – Enhancing Identity and Access Management

NIST is focusing on three major national critical infrastructure programs where effective cybersecurity is a vital element: the internet infrastructure, Energy Infrastructure Cybersecurity, and cybersecurity aspects of electronic voting.

In FY18, multiple NIST publications contributed to showing how to remedy serious security and robustness vulnerabilities in network infrastructures. Cybersecurity practice guides were developed with step-by-step example solutions using commercially available technologies. These included SP 1800-6,60 which shows how to combat spear phishing by improving assurance of the correctness of email sources, destinations, and cryptographic protection of email, and SP 1800-14,61 which explains how service providers can better control routing of internet traffic. NIST also initiated a network infrastructure project to illustrate how to better manage cryptographic certificates in order to reduce system outage and security breach risks (SP 1800-16).⁶² In addition to completing ongoing network security activities in FY19, NIST plans to collaborate with government and private industry on a major feasibility demonstration effort for transitioning systems and services from IPv4 to improved IPv6 information transfer protocols.

NIST’s Special Publication 1800-6, Domain Name System-Based Electronic Mail Security, was published in January 2018. This publication documents the use of products that improve security and integrity for electronic mail users by employing the DNS-based Authentication of Named Entities (DANE) protocol to authenticate domain addresses (e.g., @nist.gov) for electronic mail and STARTTLS protocol, which provides a way to take an existing insecure connection and upgrade it to a secure connection using secure transmission protocols. Since its publication, there has been a sharp increase in the number of internet domains that deploy DANE (608% from February 2018 to February 2019). Moreover, the Department of Homeland Security’s Binding Operational Directive 18-01 now provides compulsory direction to federal executive branch departments and agencies to employ email authentication and specifies that all internet-facing email servers offer the STARTTLS protocol.

NIST also began to incorporate cybersecurity risk management into the next version of the Smart Grid Interoperability Framework. In FY19, NIST will continue to develop the next version of the Smart Grid Interoperability Framework 2.0, chair the Smart Electric Power Alliance (SEPA)⁶⁸ Smart Grid Cybersecurity Committee, support the Department of Energy’s Cyber Resilient Energy Delivery Consortium (CREDC) program,⁶⁹ finalize SP 1800-7,70 and undertake capability demonstration and documentation activities for an Energy Sector Asset Management⁷¹ project.

The Help America Vote Act (HAVA)⁷² encouraged upgrading voting equipment across the United States and established the Election Assistance Commission (EAC)⁷³ and the Technical Guidelines Development Committee (TGDC).⁷⁴ NIST chairs the TGDC and provides technical support related to human factors, security, and laboratory accreditation. Most significantly, in FY18, the TGDC adopted a new version of the Voluntary Voting Systems Guidelines (VVSG)⁷⁵ and principles developed by NIST and the EAC. In FY19, NIST will continue leading the public working groups to inform the development of voting system requirements and test strategies based on the principles and guidelines. Additionally, NIST will support the development of a Cybersecurity Framework Profile to help better manage cybersecurity risk in the election infrastructure.

Information technology is always rapidly evolving. The extraordinary growth of smart, connected technologies is a particularly promising and concerning arena since any small, connected element is a potential point of vulnerability to the local system and all connected systems. Recent attacks on major network providers have included sustained cyber-attacks launched through fringe (but connected) parts of the system. These have included WiFi controllers, closed circuit television (CCTV) cameras, printers, and baby monitors. NIST focused significant attention in FY18 on emerging network security topics, such as cybersecurity for the Internet of Things (IoT), low-power wide-area networks, public safety broadband networks, fog computing, and quantum computing. In FY19, more effort will shift to cybersecurity issues associated with the potential for 5G networks on security requirements of new use cases and new network architectures as well as the impact of artificial intelligence and machine learning on cyber defenses.

Figure 3: IoT for the GSA Smart Building, from NISTIR 8200

A Report to the President on Enhancing the Resilience of the Internet and Communications Ecosystem Against Botnets and Other Automated, Distributed Threats,⁸⁰ released on May 30, 2018, outlines government and the private sector actions that would reduce the threat of botnets and similar cyberattacks. It responds to the May 11, 2017, Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure.⁸¹ That order directed the Secretaries of Commerce and Homeland Security to lead “an open and transparent process to identify and promote action by appropriate stakeholders” with the goal of “dramatically reducing threats perpetrated by automated and distributed attacks (e.g., botnets).” In the course of the year-long effort launched by the Executive Order, the Departments determined that the opportunities and challenges of working toward dramatically reducing threats from automated, distributed attacks can be summarized in six principal themes:

Five complementary and mutually supportive goals were identified that, if realized, would dramatically reduce the threat of automated, distributed attacks and improve the resilience and redundancy of the ecosystem:

Goal 1: Identify a clear pathway toward an adaptable, sustainable, and secure technology marketplace.
Goal 2: Promote innovation in the infrastructure for dynamic adaptation to evolving threats.
Goal 3: Promote innovation at the edge of the network to prevent, detect, and mitigate automated, distributed attacks.
Goal 4: Promote and support coalitions between the security, infrastructure, and operational technology communities domestically and around the world.
Goal 5: Increase awareness and education across the ecosystem.

Figure 4: Fog computing supporting a cloud-based ecosystem for smart end-devices

Widespread adoption and continuing support for cybersecurity requires:

NIST is approaching the challenge of security status determination, monitoring, and measurement along several avenues.

to services from NIST’s NVD and DHS’s Automated Indicator Sharing (AIS)⁸⁶ tool. The research effort’s output will be an initial proposed set of cyber incident data points with associated metrics. A common lexicon is being explored through collaboration with the Department of Defense and its DoD Cybersecurity Analysis and Review (DoDCAR)⁸⁷ program to incorporate the Open Security Controls Assessment Language (OSCAL) to support the automation of reporting for cybersecurity assessment-related information.