NIST SP 800-236 日本語訳

•NIST published the first three Federal Information Processing Standards (FIPS) for post-quantum cryptography. These standards specify key-establishment and digital signature schemes that are designed to resist future attacks by quantum computers, which threaten the security of current standards. The three algorithms specified in these standards are each derived from different submissions to the NIST Post-Quantum Cryptography (PQC) Standardization Project.

•The PQC team hosted the Fifth PQC Standardization Conference in April 2024. This conference discussed the finalization of the initial PQC FIPS and the ongoing evaluation of the Round 4 Public-Key Encryption and Key-Establishment Algorithms and the Additional Digital Signature Schemes that are being considered for future standardization.

•The Multi-Party Threshold Cryptography (MPTC) and Privacy-Enhancing Cryptography (PEC) projects jointly released the initial public draft of NIST Internal Report (IR) 8214C, NIST First Call for Multi-Party Threshold Schemes (MPTS). The document’s scope includes advanced techniques, such as fully homomorphic encryption, zero-knowledge proofs, and the building blocks of secure multi-party computation. As part of an effort to obtain public comments, NIST hosted the MPTS 2023 workshop and three events of the Special Topics on Privacy and Public Auditability (STPPA).

•NIST’s Crypto Publication Review Board completed seven publication reviews, and five reviews are in progress to update and modernize the portfolio of cryptographic standards.

•A major update to the NICE Framework was released as the Version 1.0.0 Components, which incorporated changes to almost every level of the NICE Framework’s structure and includes a list of 11 learner-focused Competency Areas. The new Components were released in multiple data formats, including as part of NIST’s Cybersecurity and Privacy Reference Tool.

•NIST released two new resources in support of the NICE Strategic Plan Goal 4.6: “Expand international outreach to promote the NICE Framework and document approaches being used in other countries.” The new NICE Framework components have been translated into five languages, and a list of international Cybersecurity Skills and Workforce Frameworks is now available. The list includes a representative sample of cybersecurity, cyber-related, digital literacy skills, and workforce frameworks from countries around the world.

•The NICE Community Coordinating Council’s Promote Career Discovery Working Group launched the Cybersecurity Career Ambassador Program. The Transform Learning Process Working Group published the Landscape of Performance-Based Assessments in Cybersecurity.

•The Cybersecurity Education and Workforce Group published an update to NIST Special Publication (SP) 800-50r1 (Revision 1), Building a Cybersecurity and Privacy Learning Program.

•The Regional Alliances and Multistakeholder Partnerships to Stimulate (RAMPS) Cybersecurity Education and Workforce Development Program awarded cooperative agreements totaling nearly $6.6 million aimed at building the workforce needed to safeguard enterprises from cybersecurity risks. The grants of roughly $200,000 apiece were distributed to 33 education and community organizations in 22 states that are working to address the nation’s shortage of skilled cybersecurity employees. Learn more about the RAMPS Communities.

•Several events were held throughout FY 2024, including the NICE Conference, K12 Conference, RICET, webinars, and FISSEA.

•NIST released the final version of AI 100-2 E2023, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations.

•SP 800-218A, Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Profile, augments the secure software development practices identified in SP 800-218, Secure Software Development Framework (SSDF) with recommendations, considerations, notes, and informative references that are specific to generative AI and dual-use foundation model development.

•NIST launched a project to investigate immersive technologies and their potential cybersecurity and privacy considerations. The findings will inform a possible roadmap for NIST competencies around these technologies, focusing on cybersecurity and privacy risk management.

•NIST IR 8425A, Recommended Cybersecurity Requirements for Consumer-Grade Router Products, comprehensively maps router cybersecurity standards provisions to the NIST baseline.

•NIST held an open discussion forum and released the initial public draft of Cybersecurity White Paper (CSWP) 33, Product Development Cybersecurity Handbook for IoT Product Manufacturers, which describes considerations for developing and deploying secure IoT products across sectors and use cases and extends NIST’s work to consider the cybersecurity of IoT product component configurations.

•NIST led the IoT Interagency Federal Working Group and collaborated with the IoT Advisory Board as it developed findings and recommendations on how the U.S. can reduce barriers to adopting IoT technologies. The findings were documented in a September 2024 report.

•The phishing project team published the NIST Phish Scale User Guide handbook on applying the Phish Scale — a novel method for measuring socially engineered email attacks. The guide has been downloaded over 20,000 times since its release. The Phish Scale is used in public- and private-sector organizations around the world to aid those who manage phishing awareness training programs in enhancing training effectiveness and strengthening organizations’ security postures.

•The youth security and privacy project team continued participation in the White House Kids Online Health and Safety (KOHS) Task Force. NIST provided technical expertise and worked with multi-agency colleagues in three task force working groups to deliver a first-of-its-kind report, Best Practices for Families and Guidelines for Industry. This report includes: (1) best practices for parents and caregivers to promote youth online health, safety, and privacy; (2) recommended industry practices; (3) a research agenda that identifies domains of further inquiry; and (4) recommended next steps for policymakers.

•NIST published results from practitioner and researcher survey studies that explored how human-centered cybersecurity concepts can be better integrated into practice and how practitioners can better inform human-centered cybersecurity research. To address some of the challenges identified in the studies, NIST launched the Human-Centered Cybersecurity Community of Interest, an online forum that brings practitioners and researchers together to share perspectives and facilitate collaboration. NIST also co-sponsored and served on the organizing committee for ConnectCon, an interactive workshop that brings together cybersecurity experts from academia, industry, and government to identify and discuss the most pressing human-centered cybersecurity challenges that organizations face today.

•After adjudicating nearly 4,000 comments, NIST published a second public draft of all four volumes of SP 800-63-4, Digital Identity Guidelines, which provide a foundation for the inclusion of new techniques and technologies into federal IAM programs.

•NIST’s IAM team published updates to the suite of SP 800-73-5 documents, which specify the Interfaces of Personal Identity Verification (PIV) Credentials (Part 1), (Part 2), and (Part 3), and completed updates to SP 800-78-5, Cryptographic Algorithms and Key Sizes for Personal Identity Verification.

•NIST continuously updates the Face Recognition/Analysis Technology Evaluation (FRTE/FATE) to provide critical benchmarking for emerging applications of facial recognition and analysis. NIST IR 8525: Face Analysis Technology Evaluation: Age Estimation and Verification, was also released to evaluate the ability of face analysis to estimate age based on a subject’s face image, which is something essential to emerging age verification schemes.

•NIST established an NCCoE project and Cooperative Research and Development Agreement (CRADA) consortium comprised of over 20 commercial and government partners to focus on creating implementation guidelines for the use of Cryptographically Verifiable Digital Credentials for online services.

•NIST’s IAM team contributed to the final version of the Mobile Driving License Application standard (ISO/IEC 18013-7) and updated their reference implementation for the standard to facilitate testing and the certification of products.

•NIST released the initial public draft of SP 800-226, Guidelines for Evaluating Differential Privacy Guarantees. This publication focuses on differential privacy — a privacy-enhancing technology that quantifies privacy risks to individuals when their information appears in a dataset.

•NIST held the Ready, Set, Update! Privacy Framework 1.1 + Data Governance and Management (DGM) Profile Workshop to inform an update of the NIST Privacy Framework to Version 1.1 and the development of the DGM Profile. NIST also released concept papers for the Privacy Framework, Version 1.1 and the DGM Profile in advance of the workshop.

•NIST published Diverse Community Data for Benchmarking Data Privacy Algorithms to disseminate major findings from the Collaborative Research Cycle (CRC) — a community challenge to evaluate de-identification algorithms.

•NIST released the Collaborative Research Cycle (CRC) Data and Metrics Archive, which is the largest global synthetic data evaluation ever performed—and an ongoing program that leads advancements in synthetic data technology. The program has over a dozen citations and has been featured in multiple conferences and workshops.

•NIST published the Cybersecurity Framework (CSF) Version 2.0 in February 2024 after a process of extensive stakeholder collaboration. New implementation resources were published to accompany the Framework, including profiles, quick start guides, and informative references. NIST also worked with stakeholders around the world to translate and verify international translations of the CSF and associated resources.

•NIST used the SP 800-53 Public Comment Site to propose new controls, hold a public comment period, and issue revised controls and assessment procedures within 30 days in response to a gap in the control catalog.

•Additional resources for implementers were released, including a series of free, self-paced online introductory courses on security and privacy controls, assessment procedures, control baselines, and the NIST Risk Management Framework for Small Enterprises Quick Start Guide (QSG).

•NIST continued to lead and support community engagement on cybersecurity supply chain risk management (C-SCRM) through the Software and Supply Chain Assurance (SSCA) Forum and Engineering Biology Research Consortium Workshops, support the Federal Acquisition Security Council, and issued two QSGs on establishing a C-SCRM capability using the CSF 2.0 and conducting due diligence on potential suppliers before procurement.

•NIST released beta prototypes of the Cyber Incident Data Analysis Repository and Cyber Supply Chain Survey Tool for stakeholder feedback and improvement. The prototypes are designed to anonymously collect and share cybersecurity incident and supply chain data for measurement and metrics analytics and to provide users with educational and informative resources to improve their C-SCRM.

•NIST launched the hardware security program to identify existing and emerging cybersecurity threats and develop mitigation techniques for semiconductors, including cybersecurity and supply chain standards, guidelines, and recommended practices in collaboration with the semiconductor community. NIST also hosted a Supply Chain workshop and published NIST IR 8540, Report on Secure Hardware Assurance Reference Dataset Program.

•To support data safeguarding, NIST released NIST IR 8432, Cybersecurity of Genomic Data; SP 1800-28, Data Confidentiality: Identifying and Protecting Assets Against Data Breaches; SP 1800-29, Data Confidentiality: Detect, Respond to, and Recover from Data Breaches; and NIST IR 8496, Data Classification Concepts and Considerations for Improving Data Protection.

•NIST published SP 1800-38B, Migration to Post-Quantum Cryptography (PQC) Quantum Readiness: Cryptographic Discovery, and SP 1800-38C, Migration to PQC Quantum Readiness: Testing Draft Standards.

•NIST published SP 800-231, Bugs Framework (BF): Formalizing Cybersecurity Weaknesses and Vulnerabilities; SP 800-204D, Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines; SP 800-218A, Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile; and enhanced the Software Assurance Reference Dataset (SARD) with four test suites from the Static Analysis Tool Exposition (SATE) VI. NIST also improved the AI Bug Finder, and the National Software Reference Database added data from 10,000+ new or updated applications (totaling over 42 million files) to assist with computer security and digital forensics analysis.

•NIST published CSWP 36, Applying 5G Cybersecurity and Privacy Capabilities: Introduction to the White Paper Series; CSWP 36A, Protecting Subscriber Identifiers with Subscription Concealed Identifier (SUCI): Applying 5G Cybersecurity and Privacy Capabilities; CSWP 36B, Using Hardware-Enabled Security to Ensure 5G System Platform Integrity: Applying 5G Cybersecurity and Privacy Capabilities; and CSWP 36C, Reallocation of Temporary Identities: Applying 5G Cybersecurity and Privacy Capabilities.

•NIST received approval to continue sponsorship of the National Cybersecurity Federally Funded Research and Development Center (FFRDC), which is now in its tenth year.

•The NCCoE held 167 active Cooperative Research and Development Agreements (CRADAs) in 2024 with industry, government, and academic organizations to provide in-kind contributions of technology and expertise toward NCCoE projects. New consortia were established for water cybersecurity and mobile driver’s license projects, and the migration to post-quantum cryptography consortium grew to over 40 organizations. The NCCoE announced new collaborations with SEMI on semiconductor manufacturing cybersecurity and Hudson Alpha and the University of Alabama in Huntsville on the cybersecurity and privacy of genomic data. NCCoE had a cumulative total of 758 collaborators working on NCCoE projects, with 26,714 companies and organizations producing cybersecurity guides and other products.

•The NCCoE partnered with 39 National Cybersecurity Excellence Partners (NCEPs) and led U.S. organizations to provide insights into emerging cybersecurity and privacy technology issues. Joint meetings of the NCEPs were hosted by the NCCoE, Dell, and Cloudflare. The NCCoE also held Interagency Agreements with the Department of State, the U.S. Navy, and the U.S. Space Force.

•The NCCoE released 25 publications — including NIST 1800-Series Special Publications, Interagency Reports, Cybersecurity White Papers, and new GitHub publications — to provide guidelines for data security, genomic data cybersecurity and privacy, zero trust architectures, 5G cybersecurity, post-quantum cryptography migration, data classification practices, supply chain traceability, smart inverters, water cybersecurity, and more.

•The NCCoE introduced a new series of 5G Cybersecurity White Papers to offer short-form content that is easy to digest for a broader audience. Other outputs included the NIST Dioptra AI open-source test platform and GitHub Pages for several projects.

•The NCCoE increased its efforts on CSF 2.0 Community Profiles to help organizations implement the new CSF.

•The NCCoE held 17 events and webinars in FY 2024, including CSF 2.0 Community Profile webinars, and continued to host quarterly Cybersecurity Connections networking events for the small business community in partnership with the State of Maryland (MD) and Montgomery County, MD. The NCCoE also launched a new LinkedIn page and the NCCoE Speakers Corner to increase awareness of the Center.

•The NCCoE continued its summer internship program for undergraduate and graduate students for the 14th year. The NCCoE also participated in NIST’s Summer Institute to provide cybersecurity resources to middle school teachers.

•The NCCoE continued to expand its cybersecurity and privacy topics, including post-quantum cryptography, natural language processing, trusted IoT, resilience for critical infrastructure and supply chains, and NIST Framework resources and tools.

•The NIST Cybersecurity and Privacy Program hosted over 80 events in FY 2024, including conferences, workshops, collaborative meetings, webinars, panel discussions, forums, and working groups.

•NIST worked closely with event attendees to share information, collaborate with the public, and hold active discussions with cybersecurity and privacy experts across sectors and industries. These open discussions and collaborative interactions helped inform NIST’s work, and the events streamlined NIST’s information-sharing abilities with key audiences.

•NIST’s cybersecurity and privacy event details are located on websites across our NCCoE events page, CSRC events page, and our NIST events overview page.

•Details on engaging with NIST are available here.

•Many NIST projects are supported by guest researchers, both foreign and domestic.

•The Pathways Program supports Federal Government internships for students and recent graduates.

•NIST funds industrial and academic research in several ways:

•The Small Business Innovation Research Program (SBIR) funds research and development proposals.

•NIST offers grants to encourage work in the fields of precision measurement, fire research, and materials science. For general information on NIST’s grant programs, please contact Christopher Hunton at grants@nist.gov.

•The Information Technology Laboratory (ITL) Speakers Bureau enables engagement with universities and colleges to raise student and faculty awareness about the exciting work going on at NIST and motivate them to consider pursuing opportunities to work with ITL.

•More information about NIST’s research, projects, publications, and events can be found on the NIST Computer Security Resource Center (CSRC) website and the NIST Cybersecurity website.