Nistir 7536 2008 CSD Annual Report

Computer Security Division
2008 Annual Report
TABLE OF CONTENTS
Welcome 1
DivisionOrganization 2
TheComputerSecurityDivisionRespondstothe
FederalInformationSecurityManagementActof2002 3
SecurityManagementandAssistanceGroup(SMA) 4
FISMAImplementationProject 4
Publications 6
OutreachandAwareness 8
HealthInformationTechnology 13
SecurityTestingandMetricsGroup(STM) 14
ValidationProgramsandLaboratoryAccreditation 14
SecurityTechnologyGroup(ST) 19
CryptographicStandardsToolkit 19
QuantumComputing 21
Authentication 22
SecurityAspectsofElectronicVoting 22
SystemsandNetworkSecurityGroup(SNS) 23
IdentityManagementSystems 23
BiometricStandardsandConformityAssessmentActivities 30
ResearchinEmergingTechnologies 34
TechnicalSecurityMetrics 38
AutomatedVulnerabilityManagementandMeasurement 40
InfrastructureServices,Protocols,andApplications 42
CSDsRoleinNationalandInternationalITSecurityStandardsProcesses 46
SystemsandNetworkSecurityTechnicalGuidelines 49
HonorsandAwards 52
ComputerSecurityDivisionPublicationsFY2008 53
WaystoEngageOurDivisionandNIST 55
Acknowledgements 56
WELCOME
T
heComputerSecurityDivision(CSD),acomponentofNISTsInforma-
tionTechnologyLaboratory(ITL),providesstandardsandtechnology
toprotectinformationsystemsagainstthreatstothecondentiality,
integrity,andavailabilityofinformationandservices.DuringFiscalYear2008
(FY2008),CSD successfully responded to numerous challenges and oppor-
tunitiesinfulllingitsmission. CSDcarriedoutadiverseresearchagenda
andparticipatedinmanynationalpriorityinitiatives,leadingtothedevelop-
mentandimplementationofhigh-quality,cost-effectivesecurityandprivacy
mechanismsthatimprovedinformationsecurityacrossthefederalgovern-
ment and throughout the national and international information security
community.
InFY2008,CSDcontinuedtodevelopstandards,metrics,tests,andvalida-
tionprogramstopromote,measure,andvalidatethesecurityininformation
systems and services.Recognizing the potential benets of more automa-
tion in technical security operations, CSD hosted the Information Security
Automation Program (ISAP), which formalizes and advances efforts to
enable the automation and standardization of technical security opera-
tions,includingautomatedvulnerabilitymanagementandpolicycompliance
evaluations.TheCSDalsocontinuedtoworkcloselywithfederalagenciesto
improvetheirunderstandingandimplementationoftheFederalInformation
SecurityManagementAct(FISMA)toprotecttheirinformationandinforma-
tionsystems. CSDsupportedamajorintelligencecommunityandnational
security community initiative to build a unied framework for information
securityacrossthefederalgovernment. Thisinitiativeisexpectedtoresultin
greaterstandardizationandmoreconsistentandcost-effectivesecurityfor
allfederalinformationsystems.
As technology advances and security requirements evolve, CSD critically
evaluates existing standards, guidelines, and technologies to ensure that
they adequately reect the current state of the art.In FY2008,CSD issued
revisionsofTheKeyed-HashMessageAuthenticationCode,FederalInforma-
tionProcessingStandard(FIPS)198-1andSecureHashStandard,FIPS180-3,
as well as a draft for public comment of the RSA Strong Primes - Digital
Signature Standard, FIPS 186-3. The CSD also initiated an international
competitionforanextgenerationSecureHashAlgorithm(SHA-3).
During FY2008 CSD explored opportunities to apply its security research
to national priorities and internal NIST initiatives.The CSD has played an
active role in implementation planning for the Comprehensive National
CyberSecurityInitiativetoprotectourcountryscriticalinfrastructure. The
CSD continued to expand its support for two key national initiatives,elec-
tronicvotingandhealthinformationtechnology,byresearchingthesecurity
requirementsofthoseareasandapplyingtheresultsofthatresearch,along
with current technologies,to advance the stated goals of those initiatives.
CSDalsoworkedcloselywiththeITLmanagementteamtointegratesecurity
projectsintoITLsresearchprograms.Theseprograms,whichincludeCyber
Security, Pervasive Information Technologies, Identity Management, and
TrustworthySoftware,aredesignedtoorganizeandbuildITLcorecompeten-
ciesinthemostefcientmanner,andtomaximizetheuseofITLresourcesto
addressemerginginformationtechnologychallenges.
These are just some of the highlights of the CSD program during FY2008.
YoumayobtainmoreinformationaboutCSDsprogramathttp://csrc.nist.gov
orbycontactinganyoftheCSDexpertsnotedinthisreport.Ifinterestedin
participating in any CSD challenges whether current or future please
contactanyofthelistedCSDexperts.
WilliamCurtisBarker
ChiefCybersecurityAdvisor
1
2 0 0 8 A N N U A L R E P O R T
William Burr
Security Technology
David Ferraiolo
Systems and Network Security
Matthew Scholl
Security Management & Assistance
Donna Dodson
Security Testing & Metrics (Acting)
William Curtis Barker
Chief Cybersecurity Advisor
Donna Dodson
Deputy Chief Cybersecurity Advisor
Division Organization
Group Managers
2
2 0 0 8 A N N U A L R E P O R T

The Computer Security
Division Responds to the
Federal Information Security
Management Act of 2002
T
he E-Government Act [Public Law 107-347], passed by the 107th
Congress and signed into law by the President in December 2002,
recognized the importance of information security to the economic
andnationalsecurityinterestsoftheUnitedStates.TitleIIIoftheE-Govern-
ment Act, entitled the Federal Information Security Management Act of
2002(FISMA),includeddutiesandresponsibilitiesfortheComputerSecurity
Division (CSD) in Section 303 National Institute of Standards and Tech-
nology. In 2008, CSD addressed its assignments through the following
projectsandactivities:
Develop NIST guides for securing non-national security agency
information systems IssuedeighteenNISTSpecialPublications(SP)
covering management, operational and technical security guidance.
Collaborated with the Ofce of the Director of National Intelligence
and the Department of Defense to transform the certication and
accreditation process for information systems into a common frame-
workforinformationsecurityacrossthefederalgovernment.
Dene minimum information security requirements (manage-
ment, operational, and technical security controls) for infor-
mation and information systems in each such category Issued
revision 2 of SP 800-53,Recommended Security Controls for Federal
InformationSystems,inDecember2007.
Identify methods for assessing effectiveness of security require-
ments -IssuedSP800-53A,GuideforAssessingtheSecurityControls
inFederalInformationSystems,inJune2008.
Establish performance measures for agency information security
policies and practices Issuedrevision1ofSP800-55,Performance
MeasurementGuideforInformationSecurity,inJuly2008.
Provide assistance to agencies and private sector Conducted
ongoing, substantial reimbursable and non-reimbursable assistance
support, including many outreach efforts such as the Federal Infor-
mation Systems Security EducatorsAssociation (FISSEA),the Federal
ComputerSecurityProgramManagersForum(FCSMForum),theSmall
Business Corner, and the Program Review for Information Security
ManagementAssistance(PRISMA).
Evaluate security policies and technologies from the private
sector and national security systems for potential federal agency
use Hostedagrowingrepositoryoffederalagencysecuritypractices,
public/private security practices,and security conguration checklists
for IT products. In conjunction with the Government of Canadas
CommunicationsSecurityEstablishment,CSDleadstheCryptographic
ModuleValidationProgram(CMVP). TheCommonCriteriaEvaluation
andValidationScheme(CCEVS)andCMVPfacilitatesecuritytestingof
ITproductsusablebythefederalgovernment.
Solicit recommendations of the Information Security and Privacy
Advisory Board on draft standards and guidelines Solicited
recommendationsoftheBoardregularlyatquarterlymeetings.
Provide outreach, workshops, and briengs Conductedongoing
awareness briengs and outreach to CSDs customer community
and beyond to ensure comprehension of guidance and awareness of
planned and future activities. CSD also held workshops to identify
areas that the customer community wishes to be addressed, and to
scopeguidelinesinacollaborativeandopenformat.
Satisfy annual NIST reporting requirement Producedanannual
report as a NIST Interagency Report (IR). The 2003-2007 Annual
Reports are available via our Computer Security Resource Center
(CSRC)websiteoruponrequest.
3
S E C U R I T Y M A N A G E M E N T A N D A S S I S T A N C E G R O U P ( S M A )

STRATEGIC GOAL4The Security Management and Assistance Group provides leadership, expertise, outreach, standards
and guidelines in order to assist the federal IT community in protecting its information and
information systems, which allows our federal customers to use these critical assets in accomplishing
their missions.
Security Management and
Assistance Group (SMA)
2 0 0 8 A N N U A L R E P O R T
Overview
I
nformationsecurityisanintegralelementofsoundmanagement. Infor-
mation and information systems are critical assets that support the
mission of an organization. Protecting them can be as important as
protectingotherorganizationalresources,suchasmoney,physicalassets,or
employees. However,includingsecurityconsiderationsinthemanagement
ofinformationandcomputersdoesnotcompletelyeliminatethepossibility
thattheseassetswillbeharmed.
Ultimately,responsibilityforthesuccessofanorganizationlieswithitssenior
management.Theyestablishtheorganizationscomputersecurityprogram
anditsoverallprogramgoals,objectives,andprioritiesinordertosupport
themissionoftheorganization. Theyarealsoresponsibleforensuringthat
requiredresourcesareappliedtotheprogram.
Collaborationwithanumberofentitiesiscriticalforsuccess. Federally,we
collaboratewiththeUnitedStatesOfceofManagementandBudget(OMB),
the United States Government Accountability Ofce (GAO), the National
SecurityAgency(NSA),theChiefInformationOfcers(CIO)Council,andall
ExecutiveBranchagencies. Wealsoworkcloselywithanumberofinforma-
tion technology organizations and standards bodies,as well as public and
privateorganizations.
MajorinitiativesinthisareaincludetheFISMAImplementationProject:
Extendedoutreachinitiativestofederalandnonfederalagencies;
Informationsecuritytraining,awarenessandeducation;
Outreachtosmallandmediumbusiness;
Standardsdevelopment;
Producing and updating NIST Special Publications (SP) on security
managementtopics.
Keytothesuccessofthisareaisourabilitytointeractwithabroadconstitu-
encyfederalandnonfederal--inordertoensurethatourprogramisconsis-
tentwithnationalobjectivesrelatedtoorimpactedbyinformationsecurity.
Federal Information Security Management Act (FISMA)
Implementation Project
TheComputerSecurityDivision(CSD)continuedtodevelopthesecuritystan-
dards and guidelines required by federal legislation. Phase I of the FISMA
Implementation Project included the development of the following publica-
tions
Federal Information Processing Standard (FIPS) 199, Standards for
Security Categorization of Federal Information and Information
Systems;
FIPS200,MinimumSecurityRequirementsforFederalInformationand
InformationSystems;
NISTSpecialPublication(SP)800-37,GuidefortheSecurityCertica-
tionandAccreditationofFederalInformationSystems;
NISTSP800-39,ManagingRiskfromInformationSystems: AnOrgani-
zationalPerspective(TargetedCompletionFebruary2009);
NISTSP800-53,RecommendedSecurityControlsforFederalInforma-
tionSystems;
NISTSP800-53A,GuideforAssessingtheSecurityControlsinFederal
InformationSystems;
NISTSP800-59,GuidelineforIdentifyinganInformationSystemasa
NationalSecuritySystem;and
NISTSP800-60,GuideforMappingTypesofInformationandInforma-
tionSystemstoSecurityCategories.
4
2 0 0 8 A N N U A L R E P O R T

ThesecuritystandardsandguidelinesdevelopedinPhaseIwillassist
federalagenciesin
ImplementingtheindividualstepsintheNISTRiskManagementFrame-
workaspartofawell-denedanddisciplinedsystemdevelopmentlife
cycleprocess;
Demonstrating compliance to specic requirements contained within
thelegislation;and
Establishingalevelofsecurityduediligenceacrossthefederal
government.
InFY2008,theSMAgroupcompletedthefollowingkeypublications:
Initial public draft of a major revision to NIST SP 800-37, Guide for
SecurityAuthorizationofFederalInformationSystems,workingincoop-
erationwiththeOfceoftheDirectorofNationalIntelligence(ODNI),
the Department of Defense (DOD), and the Committee on National
Security Systems (CNSS), to develop a common process to authorize
federalinformationsystemsforoperation;
SecondpublicdraftofNISTSP800-39,whichistheagshipdocument
intheseriesofFISMA-relatedpublicationsthatprovidesastructured,
yetexibleapproachformanagingthatportionofriskresultingfrom
theincorporationofinformationsystemsintothemissionandbusiness
processesoforganizations;
RevisionofNISTSP800-53, RecommendedSecurityControlsforFederal
InformationSystems,workingwithNISTsIntelligentSystemsDivision
(Manufacturing Engineering Laboratory), in collaboration with the
DepartmentofHomelandSecurityandorganizationswithinthefederal
governmentthatown,operate,andmaintainindustrialcontrolsystems,
toincorporateinNISTSP800-53guidanceonappropriatesafeguards
andcountermeasuresforfederalindustrialcontrolsystems,
Final publication of NIST SP 800-53A,which provides a new,stream-
lined,andexibleapproachfordevelopingsecurityassessmentplans
containing assessment procedures to determine the effectiveness
of security controls deployed in federal information systems. Also
completed with NIST SP 800-53A,was an initial public draft of web-
basedassessmentcases,whichweredevelopedbyaninteragencyteam
toprovidesecurityassessorswithonline,workedexamplesidentifying
specicassessoractionstepstoaccomplishforeachoftheassessment
proceduresinSP800-53A;
RevisionofNISTSP800-60,whichupdatestheinformationtypesused
byagenciestodevelopinformationsystemimpactlevelstohelpdeter-
minethecriticalityandsensitivityoffederalinformationsystems.
In addition to the above publications, the division collaborated with the
ManufacturingEngineeringLaboratoryindevelopingadraftguidetoindus-
trial control system security, NIST SP 800-82, Guide to Industrial Control
Systems (ICS) Security: Supervisory Control and DataAcquisition (SCADA)
Systems, Distributed Control Systems (DCS), and Other Control System
CongurationsSuchasProgrammableLogicControllers(PLC).
Phase II of the FISMA Implementation Project,discussed in more detail in
thenextsectionofthisannualreport,focusesonseveralnewinitiativesto
supportthedevelopmentofaprogramforcredentialingpublicandprivate
sector organizations to provide security assessment services for federal
agencies.
http://csrc.nist.gov/sec-cert
Contact:Dr.RonRoss
(301)975-5390
ron.ross@nist.gov
Organizational Credentialing Program
Phase II of the FISMA Implementation Project is focusing on building a
commonunderstandingandcapabilityforFISMAsecuritycontrolimplemen-
tationandassessmentinsupportingdevelopmentofaprogramforcreden-
tialingpublicandprivatesectororganizationstoprovidesecurityassessment
servicesofinformationsystemsforfederalagencies. Thesesecurityservices
involve the comprehensive assessment of the management, operational,
andtechnicalsecuritycontrolsinfederalinformationsystemsincludingthe
assessment of the information technology products and services used in
securitycontrolimplementation. Thesecurityassessmentserviceswilldeter-
mine the extent to which the security controls are implemented correctly,
operatingasintended,andproducingthedesiredoutcomewithrespectto
meetingthesecurityrequirementsforthesystem.
This phase of the FISMA Implementation Project includes the following
initiatives:
(1) Training Initiative: for development of training courses, Quick Start
Guides(QSGs),andFrequentlyAskedQuestions(FAQs)toestablisha
commonunderstandingoftheNISTstandardsandguidelinessupporting
eachofthestepsintheNISTRiskManagementFramework;
(2) Support Tools Initiative: for identifying common programs, reference
materials,checklists,technicalguides,toolsandtechniquessupporting
implementationandassessmentofSP800-53securitycontrols;
(3) ProductandServicesAssuranceInitiative: fordeningminimumcriteria
andguidelinesforsuppliersinspecifyingsecurityfunctionsandassur-
ances(toincludeevidenceoftestresultsfromSCAPtoolsandcongu-
5
S E C U R I T Y M A N A G E M E N T A N D A S S I S T A N C E G R O U P ( S M A ) S E C U R I T Y M A N A G E M E N T A N D A S S I S T A N C E G R O U P ( S M A )

2 0 0 8 A N N U A L R E P O R T
rationchecklists,etc.whereapplicable)ofproductsandservicesused
inimplementingSP800-53securitycontrols;
(4) OrganizationalCredentialingInitiative: drawinguponmaterialfromthe
aboveinitiativesandNISTstandardsandguidelines,deneminimum
capability and prociency criteria for credentialing public and private
sectororganizationsprovidingsecurityassessmentservicesforfederal
agencies;and
(5) Harmonization Initiative: for identifying common relationships and
themappingsofFISMAstandards,guidelinesandrequirementswith:
(i) ISO 27000 (International Organization for Standardization) series
information security management standards; and (ii) ISO 9000 and
17000 series quality management,and laboratory testing,inspection
andaccreditationstandards.Thisharmonizationisimportantformini-
mizing duplication of effort for organizations that must demonstrate
compliancetobothFISMAandISOrequirements.
In FY2008,the CSD completed the initial public draft of NIST Interagency
Report 7328, Security Assessment Provider Requirements and Customer
Responsibilities: Building a SecurityAssessment Credentialing Program for
Federal Information Systems,which provides an initial set of requirements
securityassessmentprovidersshouldsatisfytodemonstratethecapabilityto
conductinformationsystemsecuritycontrolassessmentsinaccordancewith
NISTstandardsandguidelines. ThedivisionalsocompletedasetofQuick
StartGuides(QSGs)andFrequentlyAskedQuestions(FAQs)toestablisha
commonunderstandingoftheNISTstandardsandguidelinessupportingthe
categorizationofsystemsstep(i.e.,rststep)oftheNISTRiskManagement
Framework.
http://csrc.nist.gov/sec-cert
Contacts:Mr.ArnoldJohnson Ms.PatToth
(301)975-3247 (301)975-5140
arnold.johnson@nist.gov patricia.toth@nist.gov
Publications
Glossary of Key Information Security Terms
Over the years, the Computer Security Division (CSD) has produced many
informationsecurityguidancedocumentswithdenitionsofkeytermsused.
Thedenitionforanygiventermwasnotstandardized;therefore,therewere
multipledenitionsforagiventerm. In2004,theCSDidentiedaneedto
increaseconsistencyindenitionsforkeyinformationsecuritytermsinour
documents.
TherststepwasareviewofNISTpublications(NISTInteragencyReports,
SpecialPublications,andFederalInformationProcessingStandards)todeter-
mine how key information security terms were dened in each document.
This review was completed in 2005 and resulted in a listing of each term
and all denitions for each term. Several rounds of internal and external
reviewswerecompleted,andcommentsandsuggestionswereincorporated
into the document. The document was published inApril 2006 as NISTIR
7298,GlossaryofKeyInformationSecurityTerms.
In2007,CSDinitiatedanupdatetotheGlossarytoreectnewtermsand
anydifferentdenitionsusedinourpublications,aswellastoincorporate
information assurance terms from the Committee on National Security
Systems Instruction No 4009 (CNSSI-4009). The glossary update was well
underwaywhenCSDwasnotiedthatCNSSI-4009wasbeingupdated. NIST
obtained a position on the CNSSI-4009 Glossary Working Group and has
beenworkingonthatprojectsinceearly2008.
An updated NIST glossary is expected to be released in FY2009 and will
includetheupdatedCNSSI-4009.
Contact:Mr.RichardKissel
(301)975-5017
richard.kissel@nist.gov
Guide for Mapping Types of Information and Information
Systems to Security Categories
In August 2008, NIST issued SP 800-60 Revision 1, Volume I, Guide for
MappingTypesofInformationandInformationSystemstoSecurityCatego-
ries,andVolume2,AppendicestoGuideforMappingTypesofInformation
andInformationSystemstoSecurityCategories. SP800-60,thecompanion
guidetoFIPS199,StandardsforSecurityCategorizationofFederalInforma-
tion and Information Systems,was developed to assist federal agencies in
categorizinginformationandinformationsystemsbyfacilitatingprovisionof
appropriatelevelsofinformationsecurityaccordingtoarangeoflevelsof
impactorconsequencesthatmightresultfromthecompromiseofasecurity
objective.
This revision of SP 800-60 further claries the system security categoriza-
tionprocess;discussestheimpactofsecuritycategorizationresultsonother
enterprise-wide activities such as capital planning,enterprise architecture,
and disaster recovery planning;and provides recommendations and ratio-
naleformission-basedandmanagementandsupportinformationtypes.
Contacts:Mr.KevinStine Mr.RichardKissel
(301)975-4483 (301)975-5017
kevin.stine@nist.gov richard.kissel@nist.gov
Guide to NIST Computer Security Documents
Cant nd the NIST CSD document youre looking for? Are you not sure
whichCSDdocumentsyoushouldbelookingfor?
6
2 0 0 8 A N N U A L R E P O R T S E C U R I T Y M A N A G E M E N T A N D A S S I S T A N C E G R O U P ( S M A )

Currently, there are over 300 NIST information security documents. This
number includes Federal Information Processing Standards (FIPS), the
SpecialPublication(SP)800series,InformationTechnologyLaboratory(ITL)
Bulletins, and NIST Interagency Reports (NIST IRs). These documents are
typicallylistedbypublicationtypeandnumber,orbymonthandyearinthe
caseoftheITLBulletins. Thiscanmakendingadocumentdifcultifthe
numberordateisnotknown.
InordertomakeNISTinformationsecuritydocumentsmoreaccessible,espe-
cially to those just entering the information security eld or to those with
needsforspecicdocuments,CSDdevelopedtheGuidetoNISTInformation
Security Documents. Publications are listed by type and number, and the
guidepresentsthreewaystosearchfordocuments:bytopiccluster(general
subjectmattersortopicareasusedininformationsecurity),byfamily(the
seventeen minimum security control family names in SP 800-53), and by
legalrequirement.
This guide is currently updated through the end ofAugust of FY2008,and
willbeundergoingfutureupdatestomakeaccesstoCSDpublicationseasier
forourcustomers.
Contact:Ms.PaulineBowen
(301)975-2938
pbowen@nist.gov
Performance Measures for Information Security
The requirement to measure information security performance is driven
by regulatory,nancial,and organizational reasons. A number of existing
laws,rules,andregulations,suchastheClinger-CohenAct,theGovernment
Performance and ResultsAct (GPRA),and the Federal Information Security
Management Act (FISMA), cite information performance measurement in
general and information security measurement in particular as a require-
ment. Agenciesarealsousingperformancemeasuresasmanagementtools
in their internal improvement efforts and linking implementation of their
programstoagency-levelstrategicplanningefforts.
In July 2008, NIST released SP 800-55, Revision 1, Performance Measure-
mentGuideforInformationSecurity.Thedocumentisaguidetoassistinthe
development,selection,andimplementationofmeasurestobeusedatthe
informationsystemandprogramlevels. Thesemeasurescanhelpindicate
the effectiveness of security controls applied to information systems and
supportinginformationsecurityprograms.
Contacts:Ms.MarianneSwanson Mr.KevinStine
(301)975-3293 (301)975-4483
marianne.swanson@nist.gov kevin.stine@nist.gov
Revision of the Guide to Information Technology Security Role-
Based Training Requirements
In FY2007,CSD initiated an update to SP 800-16,InformationTechnology
SecurityTrainingRequirements: ARole-andPerformance-BasedModel,for
publicreviewandcomment. OriginallypublishedinApril1998,SP800-16
containsatrainingmethodologythatfederaldepartmentsandagencies,as
well as private sector and academic institutions, can use to develop role-
basedinformationsecuritytrainingmaterial.
During FY2008 we made signicant changes to the document. We began
meeting with stakeholders of other federally focused information security
training and workforce development initiatives. The goal is to create a
multi-agency task force to reduce the potential for confusion among our
constituents by 1) developing a diagram that shows the interactions and
relationshipsbetweenthevariousinitiatives,and2)agreeingonacommon
trainingstandardthat can be used by various federal communities that
currentlyownormanagethetrainingandworkforcedevelopmentinitiatives.
SP800-16,Rev.1isexpectedtobethatcommontrainingstandard.
WeexpecttheupdateofSP800-16tobecompletedduringFY2009.
Contacts:Mr.MarkWilson Ms.PaulineBowen
(301)975-3870 (301)975-2938
mark.wilson@nist.gov pauline.bowen@nist.gov
Security Considerations in the System Development Life Cycle
Consideration of security in the System Development Life Cycle (SDLC) is
essential to implementing and integrating a comprehensive risk manage-
ment strategy for all information systems. To be most effective, informa-
tionsecuritymustbeintegratedintotheSDLCfromsysteminception. Early
integrationofsecurityintheSDLCenablesagenciestomaximizereturnon
investmentintheirsecurityprograms,through:
Early identication and mitigation of security vulnerabilities and
miscongurations,resultinginlowercostofsecuritycontrolimplemen-
tationandvulnerabilitymitigation;
Awareness of potential engineering challenges caused by mandatory
securitycontrols;
Identicationofsharedsecurityservicesandreuseofsecuritystrategies
and tools to reduce development cost and schedule while improving
securityposturethroughprovenmethodsandtechniques;
Facilitating informed executive decision making through comprehen-
siveriskmanagementinatimelymanner.
7

2 0 0 8 A N N U A L R E P O R T
InOctober2008,NISTissuedSP800-64,Revision2,SecurityConsiderations
intheSystemDevelopmentLifeCycle. ThispublicationaddressestheFISMA
directiontodevelopguidelinesrecommendingsecurityintegrationintothe
agencysestablishedSDLC,andisintendedtoassistagenciesinintegrating
essentialinformationtechnology(IT)securitystepsintotheirestablishedIT
SDLC,resultinginmorecosteffective,riskappropriatesecuritycontroliden-
tication,development,andtesting.
Contacts:Mr.RichardKissel Mr.KevinStine
(301)975-5017 (301)975-4483
richard.kissel@nist.gov kevin.stine@nist.gov
Outreach And Awareness
Computer Security Resource Center
TheComputerSecurityResourceCenter(CSRC)istheComputerSecurityDivi-
sionsWebsite. CSRCisoneofthefourmostvisitedWebsitesatNIST.Weuse
theCSRCtoencouragebroadsharingofinformationsecuritytoolsandprac-
tices,toprovidearesourceforinformationsecuritystandardsandguidelines,
andtoidentifyandlinkkeysecurityWebresourcestosupporttheindustry.
TheCSRCisanintegralcomponentofalloftheworkthatweconductand
produce. It is our repository for everyone,public or private sector,wanting
accesstoourdocumentsandotherinformationsecurity-relatedinformation.
CSRCservesasavitallinktoallourinternalandexternalcustomers.
DuringFY2008,CSRChadmorethan87.8millionrequests,whichincluded
theadditionaltrafccomingfromtheNationalVulnerabilityDatabase(NVD)
thatbecameoperationalinlateFY2005. Ofthetotal87.8millionrequests,
the CSRC received 38.2 million requests, while the NVD website received
49.6millionrequests.
TheCSRCwebsiteistheprimarysourceforgainingaccesstoNISTcomputer
securitypublications. Everydraftdocumentreleasedforpubliccommentor
naldocumentpublishedthroughtheDivisionhasbeenpostedtotheCSRC
website. Based on the web sites statistics, the ve most requested CSD
publicationsforFY2008were:
(1) SpecialPublication(SP)800-30,RiskManagementGuideforInforma-
tionTechnologySystems
(2) FederalInformationProcessingStandard(FIPS)197,AdvancedEncryp-
tionStandard
(3) SP800-48,GuidetoSecuringLegacyIEEE802.11WirelessNetworks
(4) FIPS140-2,SecurityRequirementsforCryptographicModules
(5) SP800-53Revision1and,Revision2,RecommendedSecurityControls
forFederalInformationSystems
During FY2008, the CSRC Web site was continuously updated with new
informationonallprojectpagesalongwiththepostingofnewandupdated
publications. ThenewandimprovedCSRCWebsitestandardizestheCSRC
Webpagesandmenus,andiseasiertonavigate. Someofthemajorhigh-
lightsoftheexpandedCSRCwebsiteduringFY2008were:
Creation of web pages for the 2008 Federal Information Systems
SecurityEducatorsAssociation(FISSEA)Conference;
ImprovedPublicationssectionthatincludedtheadditionoftheArchived
PublicationssectionforwithdrawnFIPSandSPs(superseded);
CryptographicModuleValidationProgram(CMVP)andCryptographic
AlgorithmValidationProgram(CAVP)project;
NationalVulnerabilityDatabase(NVD)websiteupdatedtheFederal
DesktopCoreConguration(FDCC)andSecurityContentAutomation
Protocol(SCAP)portionofwebsite;and
AdditionofassessmentcasesfortheFISMAproject,tonameafewof
themajorhighlights.
In addition to the CSRC website,CSD maintains a publications announce-
ment mailing list. This is a free email list that noties subscribers about
publicationsthathavebeenreleasedtothegeneralpublicandthathavebeen
postedtotheCSRCwebsite. Thisemaillistisavaluabletoolforthemore
than7,600subscriberswhoincludefederalgovernmentemployees,private
sector,educationalinstitutionsandindividualswithapersonalinterestinIT
security.Thisemaillistreachespeopleallovertheworld. Emailissenttothe
listonly whentheComputerSecurityDivisionreleasesapublication(Draft,
FIPSPUB,SpecialPublicationandNISTIR). Emailsareonlysentoutbythe
listadministratorPatOReilly(NIST,CSD). Individualswhoareinterested
in learning more about this list or subscribing to this list should visit this
webpageonCSRCformoreinformation:
http://csrc.nist.gov/publications/subscribe.html
Total Number of Website Requests: CSRC & NVD
N
u
m
b
e
r

o
f

R
e
q
u
e
s
t
s

(
M
i
l
l
i
o
n
s
)
100
90
CSRC only
80
CSRC & NVD
70
60
50
40
30
20
10
0
2002 2003 2004 2005 2006 2007 2008
Fiscal Year
8
Questions on the Web site should be sent to the CSRC Webmaster at:
webmaster-csrc@nist.gov.
CSRC will continue to grow and be updated in 2009. In addition,we will
beintegratingCSRCintoaNIST-wideimplementationofacontentmanage-
mentsystem.
http://csrc.nist.gov/
Contact:Mr.PatrickOReilly
(301)975-4751
patrick.oreilly@nist.gov
Federal Computer Security Program Managers Forum
The Federal Computer Security Program Managers Forum (Forum) is an
informalgroupofover800memberssponsoredbyNISTtopromotethesharing
ofsecurity-relatedinformationamongfederalagencies.TheForumstrivesto
provideanongoingopportunityformanagersoffederalinformationsecurity
programs to exchange information security materials in a timely manner,to
buildupontheexperiencesofotherprograms,andtoreducepossibleduplica-
tionofeffort.ItprovidesanorganizationalmechanismforNISTtoshareinfor-
mation directly with federal agency information security program managers
in fulllment of NISTs leadership mandate under FISMA. It assists NIST in
establishingandmaintainingrelationshipswithotherindividualsororganiza-
tionsthatareactivelyaddressinginformationsecurityissueswithinthefederal
government. Finally,it helps NIST and other federal agencies in developing
andmaintainingastrong,proactivestanceintheidenticationandresolution
ofnewstrategicandtacticalITsecurityissuesastheyemerge.
TheForumhoststheFederalAgencySecurityPractices(FASP)Website,main-
tains an extensive e-mail list, and holds an annual off-site workshop and
bimonthly meetings to discuss current issues and developments of interest
to those responsible for protecting sensitive (unclassied) federal systems
[exceptWarnerAmendmentsystems,asdenedin44USC3502(2)]. Ms.
MarianneSwanson,NISTservesastheChairpersonoftheForum. NISTalso
servesasthesecretariatoftheForum,providingnecessaryadministrativeand
logisticalsupport. ParticipationinForummeetingsisopentofederalgovern-
mentemployeeswhoparticipateinthemanagementoftheirorganizations
informationsecurityprogram.Therearenomembershipdues.
Topics of discussion at Forum meetings in FY2008 included briengs on
NISTSP800-55,PerformanceMeasurementGuideforInformationSecurity,
Internal Revenue Service certication and accreditation process, Depart-
ment of Navys SPAWAR (Space and Naval Warfare Systems Command)
program, FISMA reporting experiences, General Services Administrations
(GSA)Networkprogram,NISTsFISMAPhaseIIactivities,supplychainrisk
management and a brieng on the Cyber Counter Intelligence Plan.This
years two-day annual off-site meeting featured updates on the computer
security activities of the United States Government Accountability Ofce,
NIST,theUnitedStatesOfceofManagementandBudget,andtheDepart-
ment of Homeland Security. Briengs were also provided on electronic
authentication,securetelework,IPV6implementation,HSPD-12implemen-
tation, Federal Desktop Core Conguration (FDCC), the Security Content
Automation Protocol (SCAP),Information System Security Line of Business
on Phase II training,certication and accreditation transformation project,
and revisions to NIST SP 800-16,InformationTechnologyTraining Require-
ments: ARole-andPerformance-BasedModel . Additionally,therewasan
Inspectors General panel brieng on FISMA implementation and a panel
ofChiefInformationSecurityOfcersdiscussingtheirexperienceswiththe
accreditationprocess.
http://csrc.nist.gov/organizations/cspmf.html
Contact:Ms.MarianneSwanson
(301)975-3293
marianne.swanson@nist.gov
Federal Information Systems Security Educators Association
(FISSEA)
The Federal Information Systems Security EducatorsAssociation (FISSEA),
founded in 1987, is an organization run by and for information systems
securityprofessionalstoassistfederalagenciesinmeetingtheirinformation
systemssecurityawareness,training,andeducationresponsibilities. FISSEA
strives to elevate the general level of information systems security knowl-
edgeforthefederalgovernmentandthefederallyrelatedworkforce. FISSEA
servesasaprofessionalforumfortheexchangeofinformationandimprove-
ment of information systems security awareness, training, and education
programs. Italsoseekstoprovidefortheprofessionaldevelopmentofits
members.
FISSEA membership is open to information systems security professionals,
professional trainers and educators, and managers responsible for infor-
mation systems security training programs in federal agencies, as well as
contractorsoftheseagenciesandfacultymembersofaccreditededucational
institutionswhoareinvolvedininformationsecuritytrainingandeducation.
TherearenomembershipfeesforFISSEA;allthatisrequiredisawillingness
9

2 0 0 8 A N N U A L R E P O R T
toshareproducts,information,andexperiences. Businessisadministeredby
an11-memberExecutiveBoardthatmeetsmonthly. Boardmembersserve
two-year terms, and elections are held during the annual conference. In
March 2008, Emma Hochgesang-Noffsinger was elected to be the FISSEA
ExecutiveBoardChair.
Each year an award is presented to a candidate selected as Educator of
theYear;this award honors distinguished accomplishments in information
systems security training programs. The Educator of the Year for 2007,
awarded in March 2008,was David Kurtz of the Department ofTreasurys
Bureau of the Public Debt.There is also a contest for information security
posters,Web sites,and awareness tools with the winning entries listed on
theFISSEAWebsite.FISSEAhasasemiannualnewsletter,anactivelymain-
tainedWebsite,andalistserveasameansofcommunicationformembers.
Members are encouraged to participate in the annual FISSEA Conference
andtoserveontheFISSEAadhoctaskgroups. WeassistFISSEAwithits
operationsbyprovidingstaffsupportforseveralofitsactivitiesandbybeing
FISSEAshostagency.
FISSEA membership in 2008 spanned federal agencies, industry, military,
contractors,stategovernments,academia,thepress,andforeignorganiza-
tionstoreachover1,600membersinatotalof15countries. The800federal
agencymembersrepresent89agenciesfromtheExecutiveandLegislative
branchesofgovernment.
FISSEAconductedthreefreeworkshopsduring2008. InJuly boardmembers
SusanHanscheandMarkWilson,alongwithGeorgeBieber,TimMucklow,
Jeff Pound, and Jim Wrubel, conducted Whats Happening in the infor-
mationsystemsecurityawarenessandtrainingeldwhichwasheldatthe
DepartmentofState. InAprilSusanHanscheandLouisNumkinpresented
Whats New in Cyber Security Training. In November the workshop
featuredadiscussionofInformationSystemsSecurityQualicationsMatrix:
Complexities,Competencies,Experience,andTraining. Workshop presen-
tations are posted on the website and FISSEA will continue to offer free
workshopsin2009.
The 2008 FISSEA conference was held at NIST on March 11-13 where 165
attendeesheardpresentationstoenhancetheirawareness, training, andeduca-
tionprograms. Conferenceattendeesweregiventheopportunitytonetwork,
totourNIST,andtoparticipateinavendorexhibition. The2009conference,
whichwillbeheldonMarch24-26,willhavethethemeAwareness,Training,
andEducationTheCatalystforOrganizationalChange. Furtherinformation
regardingtheconferenceisavailableontheFISSEAWebsite.
FISSEA strives to improve federal information systems security through
awareness,training,andeducation.Stayaware,trained,andeducatedwith
FISSEA.
http://csrc.nist.gov/ssea/
Contacts:Mr.MarkWilson Ms.PeggyHimes
(301)975-3870 (301)975-2489
mark.wilson@nist.gov peggy.himes@nist.gov
The Information Security and Privacy Advisory Board
The Information Security and Privacy Advisory Board (ISPAB) is a federal
advisorycommitteethatbringstogetherseniorprofessionalsfromindustry,
government, and academia to help advise the National Institute of Stan-
dardsandTechnology(NIST),theUnitedStatesOfceofManagementand
Budget(OMB),theSecretaryofCommerce,andappropriatecommitteesof
the United States Congress about information security and privacy issues
pertainingtounclassiedfederalgovernmentinformationsystems.
The Information Security and Privacy Advisory Board Membership
Pictured above, Left to Right: Back row: Jaren Doherty, Peter Weinberger, Joseph
Guirreri, Howard Schmidt, Lisa Schlosser, Daniel Chenok, and Fred B. Schneider.
Front row: Ari Schwartz, Alexander Popowycz, Rebecca Leng, Brian Gouker, Lynn
McNulty and Pauline Bowen.
Pictured above, Left to Right: Philip Reitinger and Annie Sokol
10

ThemembershipoftheBoardconsistsof12individualsandaChairperson.
TheDirectorofNISTapprovesmembershipappointmentsandappointsthe
Chairperson.Each Board member serves for a four-year term. The Boards
membership draws from experience at all levels of information security
and privacy work.The members careers cover government, industry, and
academia. MembershaveworkedintheExecutiveandLegislativebranches
ofthefederalgovernment,civilservice,seniorexecutiveservice,themilitary,
some of the largest corporations worldwide,small and medium-size busi-
nesses,andsomeofthetopuniversitiesinthenation. Themembersexperi-
ence,likewise,coversabroadspectrumofactivitiesincludingmanydifferent
engineering disciplines, computer programming, systems analysis, mathe-
matics,managementpositions,informationtechnologyauditing,legalexpe-
rience, an extensive history of professional publications, and professional
journalism.Membershaveworked(andinmanycases,continuetoworkin
theirfull-timejobs)onthedevelopmentandevolutionofsomeofthemost
importantpiecesofinformationsecurityandprivacylegislationinthefederal
government,includingthePrivacyActof1974,theComputerSecurityActof
1987,theE-GovernmentAct(includingFISMA),andnumerouse-government
servicesandinitiatives.
Thiscombinationofexperienced,dynamic,andknowledgeableprofessionals
onanadvisoryboardprovidesNISTandthefederalgovernmentwitharich,
variedpoolofpeopleconversantwithanextraordinaryrangeoftopics.They
bringgreatdepthtoaeldthathasanexceptionalrateofchange.InFY2008
theboardlosttwolongtimemembers,LeslieA.ReisandSusanLandau.They
gainedtwomoremembers,AriSchwartzandPeterWeinberger.
ISPABwasoriginallycreatedbytheComputerSecurityActof1987(Public
Law100-35)astheComputerSystemSecurityandPrivacyAdvisoryBoard.
AsaresultofFISMA,theBoardsnamewaschangedanditsmandatewas
amended.ThescopeandobjectivesoftheBoardareto
Identify emerging managerial, technical, administrative, and physical
safeguardissuesrelativetoinformationsecurityandprivacy;
AdviseNIST,theSecretaryofCommerce,andtheDirectorofOMBon
information security and privacy issues pertaining to federal govern-
ment information systems, including thorough review of proposed
standardsandguidelinesdevelopedbyNIST;and
AnnuallyreporttheBoardsndingstotheSecretaryofCommerce,the
DirectorofOMB,theDirectoroftheNationalSecurityAgency,andthe
appropriatecommitteesoftheCongress.
The Board meets quarterly and all meetings are open to the public. NIST
provides the Board with its Secretariat. The Board has received numerous
briengsfromfederalandprivatesectorrepresentativesonawiderangeof
privacyandsecuritytopicsinthepastyear.
AreasofinterestthattheBoardwillbefollowinginFY2009include:
Privacytechnology,
EssentialBodyofKnowledge,
IndustrySecurityOfcersBestPractices,
FederalInitiativessuchas:
TrustedInternetConnection,
FederalDesktopCoreConguration,
HomelandSecurityPolicyDirective12,
IPv6,
BiometricsandIDmanagement,
Securitymetrics,
Geospatialsecurityandprivacyissues,
FISMAreauthorization(andotherlegislativesupport),
InformationSystemsSecurityLineofBusiness(ISSLOB),
Nationalsecuritycommunityactivitiesinareasrelevanttocivilian
agencysecurity(e.g.,architectures),
SupervisoryControlandDataAcquisition(SCADA)security,
HealthcareIT,
TelecommutingSecurity,
SeniorManagementsRoleinFISMAReview,
UseandImplementationofFederalITSecurityProducts,
SocialNetworkingandSecurity,
EinsteinProgram,
Role of chiefs (such as Chief Privacy Ofcer and Chief Security
Ofcer),
NISTs outreach, research, and partnering approaches, and cyber
securityleadershipintheExecutiveBranch.
http://csrc.nist.gov/ispab/
Contact:Ms.PaulineBowen
(301)975-2938
pauline.bowen@nist.gov
11
2 0 0 8 A N N U A L R E P O R T
Security Practices and Policies
Todays federal networks and systems are highly interconnected and inter-
dependentwithnonfederalsystems. Protectionofthenationscriticalinfra-
structures is dependent upon effective information security solutions and
practices that minimize vulnerabilities associated with a variety of threats.
Thebroadersharingofsuchpracticeswillenhancetheoverallsecurityofthe
nation. Informationsecuritypracticesfromthepublicandprivatesectorcan
sometimesbeappliedtoenhancetheoverallperformanceoffederalinfor-
mation security programs. We are helping to facilitate a sharing of these
practicesandimplementationguidelinesinmultipleways.
TheFederalAgencySecurityPractices(FASP)effortwasinitiatedasaresult
of the success of the federal Chief Information Ofcers (CIO) Councils
Federal Best Security Practices (BSP) pilot effort to identify, evaluate, and
disseminatebestpracticesforcriticalinfrastructureprotectionandsecurity.
Wewereaskedtoundertakethetransitionofthispilotefforttoanopera-
tionalprogram. Asaresult,wedevelopedtheFASPWebsite.TheFASPsite
contains agency policies,procedures and practices,the CIO Councils pilot
BSPs,andaFrequentlyAskedQuestions(FAQ)section. TheFASPsitediffers
fromtheBSPpilotinmaterialprovidedandcomplexity.
TheFASPareacontainsalistofcategoriesfoundinmanyoftheNISTSpecial
Publications. Basedonthesecategories,agenciesareencouragedtosubmit
theirinformationsecuritypracticesforpostingontheFASPsitesotheymay
besharedwithothers. Anyinformationon,orsamplesof,positiondescrip-
tionsforsecuritypositionsandstatementsofworkforcontractingsecurity-
relatedactivitiesarealsoencouraged. Inthepastyear,anumberofdated
practiceswereremovedfromthesiteandnewoneswereadded.
Wealsoinvitepublicandprivateorganizationstosubmittheirinformation
securitypracticestobeconsideredforinclusiononthelistofpracticesmain-
tainedontheWebsite. Policiesandproceduresmaybesubmittedtousin
anyareaofinformationsecurity,includingaccreditation,audittrails,authori-
zationofprocessing,budgetplanningandjustication,certication,contin-
gencyplanning,dataintegrity,disasterplanning,documentation,hardware
andsystemmaintenance,identicationandauthentication,incidenthandling
and response, life cycle, network security, personnel security, physical and
environmental protection,production input/output controls,security policy,
programmanagement,reviewofsecuritycontrols,riskmanagement,security
awareness training and education (including specic training course and
awarenessmaterials),andsecurityplanning.
InFY2009,wewillcontinuethemomentumtoexpandthenumberofsample
practices and policies made available to federal agencies and the public.
Wearecurrentlyidentifyingrobustsourcesformoresamplestoaddtothis
growingrepository. Weplantotakeadvantageoftheadvancesincommu-
nication technology and combine this outreach with other outreach areas
forinformationsecurityinordertoreachmanyinthefederalagenciesand
thepublic.
http://fasp.nist.gov/
Contacts:Ms.PaulineBowen Mr.MarkWilson
(301)975-2938 (301)975-3870
pauline.bowen@nist.gov mark.wilson@nist.gov
Small and Medium-Size Business Outreach
Whatdoabusinesssinvoiceshaveincommonwithe-mail? Ifbotharedone
onthesamecomputer,thebusinessownermaywanttothinkmoreabout
computer security. Information payroll records, proprietary information,
client,oremployeedataisessentialtoabusinessssuccess. Acomputer
failureorothersystembreachcouldcostabusinessanythingfromitsreputa-
tiontodamagesandrecoverycosts. Thesmallbusinessownerwhorecog-
nizes the threat of computer crime and takes steps to deter inappropriate
activitiesislesslikelytobecomeavictim.
The vulnerability of any one small business may not seem signicant to
many,otherthantheownerandemployeesofthatbusiness. However,over
20 million United States businesses, comprising more than 95 percent of
allUnitedStatesbusinesses,aresmallandmedium-sizebusinesses(SMBs)
of 500 employees or less. Therefore, a vulnerability common to a large
percentageofallSMBscouldposeathreattothenationseconomicbase.
Inthespecialarenaofinformationsecurity,vulnerableSMBsalsoruntherisk
ofbeingcompromisedforuseincrimesagainstgovernmentalorlargeindus-
trialsystemsuponwhicheveryonerelies. SMBsfrequentlycannotjustifyan
extensivesecurityprogramorafull-timeexpert. Nonetheless,theyconfront
serious security challenges and must address security requirements based
onidentiedneeds.
Thedifcultyforthesebusinessesistoidentifyneededsecuritymechanisms
andtrainingthatarepracticalandcost-effective.Suchbusinessesalsoneed
tobecomemoreeducatedintermsofsecuritysothatlimitedresourcesare
wellappliedtomeetthemostobviousandseriousthreats. Toaddressthis
need,NIST,theSmallBusinessAdministration(SBA),andtheFederalBureau
ofInvestigation(FBI)agreedtocosponsoraseriesoftrainingmeetingson
computer security for small businesses. The purpose of the meetings is to
provide an overview of information security threats, vulnerabilities, and
correspondingprotectivetoolsandtechniques,withaspecialemphasison
providingusefulinformationthatsmallbusinesspersonnelcanapplydirectly
orusetotaskcontractorpersonnel.
12
InFY2008,theSMBoutreacheffortfocusedonexpandingopportunitiesto
reachmoresmallbusinesses,andnineSMBworkshopswereheldacrossthe
country. InJuly2008,twohalf-dayworkshopswereheldinBuffalo,NY,and
Houston,TX. Similar workshops were held inAugust 2008 in Kansas City,
MO,Sacramento,CAandHonolulu,HI. Additionalworkshopswereheldin
SeptemberinMilwaukee,WI,Springeld,IL,Chicago,IL,andStLouis,MO.
http://sbc.nist.gov/
Contact:Mr.RichardKissel
(301)975-5017
richard.kissel@nist.gov
Health Information Technology
In April 2004, the President issued a plan for a healthcare system in the
UnitedStatesthatputstheneedsofthepatientrst,ismoreefcient,andis
cost-effective. ThePresidentsplanisbasedonthefollowingtenets:
Medical information will follow consumers so that they are at the
centeroftheirowncare.
Consumers will be able to choose physicians and hospitals based on
clinicalperformanceresultsmadeavailabletothem.
Clinicianswillhaveapatientscompletemedicalhistory,computerized
orderingsystems,andelectronicreminders.
Quality initiatives will measure performance and drive quality-based
competitionintheindustry.
Public health and bioterrorism surveillance will be seamlessly inte-
gratedintocare.
Clinical research will be accelerated and post-marketing surveillance
willbeexpanded.
Together, thesetenetsaredirectedtowardmakinghealthcaremoreconsumer-
centric,andimprovingboththequalityandtheefciencyofhealthcareinthe
UnitedStates. Criticalcomponentsofthesetenetsistheassuranceofprivacy
ofhealth-relatedinformation,assuringthecondentialityandintegrityofall
health information technology (HIT) data and maintaining the availability
to HIT whenever it is needed. The CSD is involved in assisting healthcare
providersinthiseffort.
CSDparticipateswith,andisconsultedby,agencies,organizations,andstan-
dardspanelsthatareshapingtheHITarena,including:
American Health Information Communitys (AHIC) Condentiality,
Privacy,andSecurityWorkgroup;
NationwideHealthInformationNetwork(NHIN);
HealthcareInformationTechnologyStandardsPanel(HITSP);and
Certication Commission for Healthcare Information Technology
(CCHIT).
InFY2008,CSDalsoissuedacomprehensiveupdateofNISTSP800-66,An
IntroductoryResourceGuideforImplementingtheHealthInsurancePorta-
bilityandAccountabilityAct(HIPAA)SecurityRule. ThisSPdiscussessecurity
considerations and resources that may provide value when implementing
therequirementsoftheHIPAASecurityRule. Thepublication:
Helpstoeducatereadersaboutinformationsecuritytermsusedinthe
HIPAASecurityRuleandtoimproveunderstandingofthemeaningof
thesecuritystandardssetoutintheSecurityRule;
Directs readers to helpful information in other NIST publications on
individualtopicsaddressedbytheHIPAASecurityRule;and
Aids readers in understanding the security concepts discussed in the
HIPAASecurityRule.Thispublicationdoesnotsupplement,replace,or
supersedetheHIPAASecurityRuleitself.
To provide additional outreach and reinforce the security concepts in the
Security Rule, NIST, in conjunction with the Centers for Medicare and
MedicaidServices(CMS)OfceofE-HealthStandardsandServices(OESS),
conducted a HIPAA Security Rule Implementation workshop in January
2008. Thisconferenceprovidednearly200attendeeswithanopportunityto
discuss challenges,tips,techniques,and issues surrounding implementing,
adhering to, and auditing HIPAA Security Rule requirements, and to hear
from various government and industry healthcare and health information
technology organizations about their HIPAA Security Rule implementation
strategiesandexperiences.
Contacts:Mr.MatthewScholl Mr.KevinStine
(301)975-2941 (301)975-4483
mscholl@nist.gov kevin.stine@nist.gov
13
S E C U R I T Y T E S T I N G A N D M E T R I C S G R O U P ( S T M )

STRATEGIC GOAL4Improve the security and technical quality of cryptographic products needed by federal agencies
(in the United States, Canada, and the United Kingdom) and industry by developing standards,
test methods and validation criteria, and the accreditation of independent third-party testing
laboratories.
SECURITY TESTING AND
METRICS GROUP (STM)
2 0 0 8 A N N U A L R E P O R T
Overview
F
ederal agencies,industry,and the public rely on cryptography for the
protection of information and communications used in electronic
commerce,critical infrastructure,and other application areas. At the
core of all products offering cryptographic services is the cryptographic
module. Cryptographic modules, which contain cryptographic algorithms,
areusedinproductsandsystemstoprovidesecurityservicessuchascon-
dentiality,integrity,and authentication. Although cryptography is used to
provide security,weaknesses such as poor design or weak algorithms can
render a product insecure and place highly sensitive information at risk.
Whenprotectingtheirsensitivedata,federalgovernmentagenciesrequirea
minimumlevelofassurancethatcryptographicproductsmeettheirsecurity
requirements. Also, federal agencies are required to use only tested and
validated cryptographic modules. Adequate testing and validation of the
cryptographic module and its underlying cryptographic algorithms against
establishedstandardsisessentialtoprovidesecurityassurance.
Ourtesting-focusedactivitiesincludevalidatingcryptographicmodulesand
cryptographicalgorithmimplementations,developingtestsuites,providing
technical support to industry forums, and conducting education, training,
andoutreachprograms.
Activities in this area involve collaboration and the facilitation of relation-
shipswithotherentities. Federalagenciesthathavecollaboratedrecently
with these activities are the Department of State, the Department of
Commerce,theDepartmentofDefense,theGeneralServicesAdministration,
the NationalAeronautics and SpaceAdministration, the National Security
Agency,theDepartmentofEnergy,theUnitedStatesOfceofManagement
and Budget, the Social Security Administration, the United States Postal
Service, the Department ofVeteransAffairs, the FederalAviationAdminis-
tration, and NISTs National Voluntary Laboratory Accreditation Program.
Industry entities that have worked with us in this area is long include the
AmericanNationalStandardsInstitute(ANSI),Oracle,CiscoSystems,Lucent
Technologies,MicrosoftCorporation,InternationalBusinessMachines(IBM),
VISA,MasterCard,ComputerAssociates,RSA Security,Research in Motion,
Sun Microsystems,NetworkAssociates,Entrust,and FortressTechnologies.
TheDivisionalsohascollaboratedinthisareaattheinternationallevelwith
Canada,theUnitedKingdom,France,Germany,India,Japan,andKorea.
Validation Programs And Laboratory Accreditation
The Cryptographic Module Validation Program (CMVP) and the Crypto-
graphic Algorithm Validation Program (CAVP) were developed by NIST to
support the needs of the user community for strong independently tested
andcommerciallyavailablecryptographicproducts.Theprogramsworkwith
thecommercialsectorandthecryptographiccommunitytoachievesecurity,
interoperability,and assurance. The goal of these programs is to promote
theuseofvalidatedproductsandprovidefederalagencieswithasecurity
metrictouseinprocuringcryptographicmodules.Thetestingperformedby
accreditedlaboratoriesprovidesthismetric.Federalagencies,industry,and
the public can choose cryptographic modules and/or products containing
cryptographic modules from the CMVP Validated Modules List and have
condenceintheclaimedlevelofsecurity.
The CMVP provides a documented methodology for conformance testing
through a dened set of security requirements in Federal Information
ProcessingStandard(FIPS)140-2,SecurityRequirementsforCryptographic
Modules,andothercryptographicstandards.Federalagenciesarerequired
tousemodulesthatwerevalidatedasconformingtotheprovisionsofFIPS
140-2. We developed the standard and an associated metric (the Derived
TestRequirements)toensurerepeatabilityoftestsandequivalencyinresults
acrossthetestinglaboratories.ThecommercialCryptographicandSecurity
Testing (CST) laboratories accredited by the NationalVoluntary Laboratory
AccreditationProgram(NVLAP)providevendorsofcryptographicmodulesa
choiceoftestingfacilitiesandpromotehealthycompetition. Inthecharton
thenextpage,theacronymIUTisknownasImplementationUnderTest.
14
2 0 0 8 A N N U A L R E P O R T
General flow of fIPS 140-2 Testing and Validation
Vendor selects a lab;
NVLAP Accredited
Submits module for testing;
1
Cryptographic Module
FIPS 140-2 Module IUT Vendor
CMT Lab
Lab submits questions
for guidance and
Test for conformance
clarification
Issue validation
to FIPS 140-2;
Writes test report
1a NIST/CSE issue
testing and
implementation
certificate
(via lab to the
vendor)
4 Module
Guidance
5a
Coordination
Cost Recovery Fee
Received Prior to
Modules
Validation
Test Report
2
CMT Test Report to NIST/CSE
for validation;
NIST/CSE
3
Module Review Pending
Reviewer Assigned
Module Under Review
List of Validated
Finalization;
FIPS 140-2
NIST adds module to validated modules list at
Modules www.nist.gov/cmvp
5
Laboratory Accreditation
Vendorsofcryptographicmodulesandalgorithmsuseindependent,private
sectortestinglaboratoriesaccreditedasCSTlaboratoriesbyNVLAPtohave
theircryptographicmodulesvalidatedbytheCMVPandtheircryptographic
algorithmsvalidatedbytheCAVP. Astheworldwidegrowthanduseofcryp-
tographicmoduleshasincreased,demandtomeetthetestingneedsforboth
algorithms and modules developed by vendors has also grown.There are
currently13accreditedlaboratoriesintheUnitedStates,Canada,theUnited
Kingdom and Germany. NVLAP has received several applications for the
accreditation of CST Laboratories,both domestically and internationally.A
completelistofaccreditedlaboratoriesmaybefoundathttp://csrc.nist.gov/
groups/STM/testing_labs/index.html.
http://ts.nist.gov/standards/accreditation/index.cfm
Contact:Mr.RandallJ.Easter
(301)975-4641
randall.easter@nist.gov
Cryptographic Module Validation Program and Cryptographic
Algorithm Validation Program
The CMVP and the CAVP are separate, collaborative programs based on a
partnership between NISTs CSD and the Communication Security Establish-
mentCanada(CSEC). TheprogramsprovidefederalagenciesintheUnited
States,Canada,and the United Kingdomwith condence that a validated
cryptographicmodulemeetsaclaimedlevelofsecurityassuranceandthata
validatedcryptographicalgorithmhasbeenimplementedcorrectly.TheCMVP/
CAVP validate modules and algorithms used in a wide variety of products,
including secure Internet browsers, secure radios, smart cards, space-based
communications, munitions, security tokens, storage devices, and products
supporting Public Key Infrastructure and electronic commerce. One module
may be used in several products so that a small number of modules may
accountforhundredsofproducts. Likewise,theCAVPvalidatescryptographic
algorithmsthatmaybehousedinoneormorecryptographicmodules.
TheCMVPandtheCAVPhavestimulatedimprovedqualityofcryptographic
modules. Statistics from the testing laboratories show that 48 percent of
thecryptographicmodulesand27percentofthecryptographicalgorithms
broughtinforvoluntarytestinghadsecurityawsthatwerecorrectedduring
testing. Without this program, the federal government would have had
onlya50-50chanceofbuyingcorrectlyimplementedcryptography. Todate,
over1045validationcerticateshavebeenissued,representingover2,086
modulesthatwerevalidatedbytheCMVP. Thesemoduleshavebeendevel-
opedbymorethan245domesticandinternationalvendors.
InFY2008,theCMVPissued182modulevalidationcerticates. Thenumber
ofmodulessubmittedforvalidationcontinuestogrow,representingsigni-
cant growth in the number of validated products expected to be available
inthefuture.
15
S E C U R I T Y T E S T I N G A N D M E T R I C S G R O U P ( S T M ) S E C U R I T Y T E S T I N G A N D M E T R I C S G R O U P ( S T M )

2 0 0 8 A N N U A L R E P O R T
0
50
100
150
200
250
300
350
400
1
9
9
5
1
9
9
6
1
9
9
7
1
9
9
8
1
9
9
9
2
0
0
0
2
0
0
1
2
0
0
2
2
0
0
3
2
0
0
4
2
0
0
5
2
0
0
6
2
0
0
7
2
0
0
8

Fiscal Year
0
50
100
150
200
Level 1 Level 2 Level 3 Level 4 Projected
1
9
9
5
1
9
9
6
1
9
9
7
1
9
9
8
1
9
9
9
2
0
0
0
2
0
0
1
2
0
0
2
2
0
0
3
2
0
0
4
2
0
0
5
2
0
0
6
2
0
0
7
2
0
0
8

Fiscal Year
The Progress of the CMVP
Validated Modules by Year and Level
(October 15, 2008)
Validation Certificates by Year and Level
(October 15, 2008)
The CAVP issued 1127 algorithm validation certicates in FY2008. During
the last two years the number of validation certicates issued has grown
signicantly. InFY2006,631algorithmvalidationcerticateswereissued,
andinFY2007,1040algorithmvalidationcerticateswereissued.
http://csrc.nist.gov/groups/STM
Contacts:
CMVPContact:Mr.RandallJ.Easter CAVPContact:Ms.SharonS.Keller
(301)975-4641 (301)975-2910
randall.easter@nist.gov sharon.keller@nist.gov
Automated Security Testing and Test Suite Development
Each approved and recommended cryptographic algorithm is specied in
a Federal Information Processing Standards (FIPS) publication or a NIST
SpecialPublication(SP). Thedetailedinstructionsonhowtoimplementthe
specicalgorithmarefoundinthesereferences. Basedontheseinstructions,
wedesignanddevelopvalidationtestsuitescontainingteststhatverifythat
the detailed instructions of an algorithm are implemented correctly and
completely. Thesetestsexercisethemathematicalformulasdetailedinthe
algorithm to assure that they work properly for each possible scenario. If
the implementer deviates from these instructions or excludes any part of
the instructions, the validation test will fail, indicating that the algorithm
implementationdoesnotfunctionproperly.
The types of validation testing available for each approved cryptographic
algorithminclude,butarenotlimitedto: KnownAnswerTests,MonteCarlo
Tests,andMulti-blockMessageTests.TheKnownAnswerTestsaredesigned
to test the conformance of the implementation under test (IUT) to the
variousspecicationsinthereference. Thisinvolvestestingthecomponents
ofthealgorithmtoassurethattheyareimplementedcorrectly. TheMonte
CarloTest is designed to exercise the entire IUT. This test is designed to
detectthepresenceofimplementationawsthatarenotdetectedwiththe
controlled input of the KnownAnswerTests.The types of implementation
awsdetectedbythisvalidationtestincludepointerproblems,insufcient
allocation of space,improper error handling,and incorrect behavior of the
IUT.TheMulti-blockMessageTest(MMT)isdesignedtotesttheabilityofthe
implementationtoprocessmulti-blockmessages,whichrequirethechaining
ofinformationfromoneblocktothenext. Othertypesofvalidationtesting
existtosatisfyothertestingrequirementsofcryptographicalgorithms.
Automatedsecuritytestingandtestsuitedevelopmentareintegralcompo-
nentsoftheCryptographicAlgorithmValidationProgram(CAVP). TheCAVP
encompasses validation testing for FIPS-approved and NIST-recommended
cryptographic algorithms. Cryptographic algorithm validation is a prereq-
uisite to the Cryptographic ModuleValidation Program (CMVP).All of the
tests under the CAVP are handled by the 13 third-party laboratories that
are accredited as CMT laboratories by NVLAP.We develop and maintain a
CryptographicAlgorithmValidationSystem(CAVS)toolwhichautomatesthe
validation testing. The CAVS currently has algorithm validation testing for
thefollowingcryptographicalgorithms:
TheTriple Data Encryption Standard (TDES) algorithm (as specied in
SP 800-67 Recommendation for theTriple Data EncryptionAlgorithm
(TDEA)BlockCipher andSP800-38ARecommendationforBlockCipher
ModesofOperation-MethodsandTechniques),
TheAdvancedEncryptionStandard(AES)algorithm(asspeciedinFIPS
197AdvancedEncryptionStandard andSP800-38A),
16
2 0 0 8 A N N U A L R E P O R T S E C U R I T Y T E S T I N G A N D M E T R I C S G R O U P ( S T M )

TheDigitalSignatureStandard(DSS)(asspec-
iedinFIPS186-2DigitalSignatureStandard
(DSS) with change notice 1 dated October 5,
2001),
Hashing algorithms SHA-1, SHA-224,
SHA-256,SHA-384,andSHA-512(asspecied
inFIPS180-2SecureHashStandard (SHS)with
changenotice1datedFebruary25,2004),
Threerandomnumbergenerator(RNG)algo-
rithms (as specied inAppendix 3.1 and 3.2
ofFIPS186-2,AppendixA.2.4ofANSIX9.31,
andAppendixA.4ofANSIX9.62),
The Deterministic Random Bit Generators
(DRBG)(asspeciedinSP800-90Recommen-
dationforRandomNumberGenerationUsing
DeterministicRandomBitGenerators),
TheRSAalgorithm(asspeciedinANSIX9.31
andPublicKeyCryptographyStandards(PKCS)
#1v2.1:RSACryptographyStandard-2002),
TheKeyed-HashMessageAuthenticationCode
(HMAC) (as specied in FIPS 198 The Keyed-
HashMessageAuthenticationCode(HMAC)),
The Counter with Cipher Block Chaining-
Message Authentication Code (CCM) mode
(asspeciedinSP800-38CRecommendation
forBlockCipherModesofOperation: theCCM
ModeforAuthenticationandCondentiality),
0
200
400
600
800
1,000
1,200
TDES
SJ
SHA
RSA
RNG
HMAC
ECDSA
DRBG
DSA
DES
AES
1
9
9
6
1
9
9
7
1
9
9
8
1
9
9
9
2
0
0
0
2
0
0
1
2
0
0
2
2
0
0
3
2
0
0
4
2
0
0
5
2
0
0
6
2
0
0
7
2
0
0
8

Fiscal Year
#

v
a
l
i
d
a
t
i
o
n

c
e
r
t
i
f
i
c
a
t
e
s

i
s
s
u
e
d

The Progress of the CAVP
(October, 2008)
Fiscal Year AES DES DSA DRBG ECDSA HMAC RNG RSA SHA SJ TDES Total
FY 1996 0 2 0 0 0 0 0 0 0 0 0 2
FY 1997 0 11 6 0 0 0 0 0 7 2 0 26
FY 1998 0 27 9 0 0 0 0 0 6 0 0 42
FY 1999 0 30 14 0 0 0 0 0 12 1 0 57
FY 2000 0 29 7 0 0 0 0 0 12 1 28 77
FY 2001 0 41 15 0 0 0 0 0 28 0 51 135
FY 2002 30 44 21 0 0 0 0 0 59 6 58 218
FY 2003 66 49 24 0 0 0 0 0 63 3 73 278
FY 2004 82 41 17 0 0 0 28 22 77 0 70 337
FY 2005 145 54 31 0 14 115 108 80 122 2 102 773
FY 2006 131 3 33 0 19 87 91 63 120 1 83 631
FY 2007 240 0 63 0 35 127 137 130 171 1 136 1,040
FY 2008 268 0 77 4 41 158 137 129 191 0 122 1,127
The Cipher-based Message Authentication
Code (CMAC) Mode for Authentication (as specied in SP 800-38B
Recommendation for Block Cipher Modes of Operation: The CMAC
ModeforAuthentication),and
TheEllipticCurveDigitalSignatureAlgorithm(ECDSA)(asspeciedin
ANSIX9.62).
InFY2009,weexpecttoaugmenttheCAVStooltoprovidealgorithmvalida-
tiontestingfor:
Key Agreement Schemes and Key Conrmation as specied in SP
800-56A Recommendation for Pair-Wise Key Establishment Schemes
UsingDiscreteLogarithmCryptography,and
TheGalois/CounterMode(GCM)GMACModeofOperation(asspeci-
edinSP800-38DRecommendationforBlockCipherModesofOpera-
tion:Galois/CounterMode(GCM)andGMAC).
http://csrc.nist.gov/groups/STM/cavp
Contact:Ms.SharonKeller
(301)975-2910
sharon.keller@nist.gov
ISO Standardization of Cryptographic Module Testing
CSD has contributed to the activities of the International Organization for
Standardization/InternationalElectrotechnicalCommission(ISO/IEC),which
issuedISO/IEC19790,SecurityRequirementsforCryptographicModules,on
March 1,2006. With the publishing of ISO/IEC 19790,Subcommittee 27
(SC27)approvedandbeganworkonISO/IEC24759,TestRequirementsfor
17

2 0 0 8 A N N U A L R E P O R T
CryptographicModules.ThisprojectwascompletedandISO/IEC24759,Test
Requirements for Cryptographic Modules, was published on July 1, 2008.
This effort will bring consistent testing of cryptographic modules in the
globalcommunity.
Atthespring2008ISO/IECmeeting,ISO/IECJTC1/SC27requestedthatits
SecretariatcirculateacallforcontributionsfortherevisionofISO/IEC19790,
Security Requirements for Cryptographic Modules.An outline of planned
NIST FIPS 140-3, Security Requirements for Cryptographic Modules, was
submitted by the United States national standards body to be considered
forthisrevision.Atthefall2008ISO/IECmeetingtheSecretariatapproved
the appointment of editors for this project,including Mr.Randall J.Easter
fromNIST.
http://csrc.nist.gov/cryptval/
Contact:Mr.RandallJ.Easter
(301)975-4641
randall.easter@nist.gov
Development of Federal Information Processing Standard (FIPS)
140-3, Security Requirements for Cryptographic Modules
FIPS140-2,SecurityRequirementsforCryptographicModules,providesfor
fourincreasing,qualitativelevelsofsecurityintendedtocoverawiderange
ofpotentialapplicationsandenvironments.Thesecurityrequirementscover
areas related to the secure design and implementation of a cryptographic
module. These areas include cryptographic module specication; crypto-
graphicmoduleportsandinterfaces;roles,services,andauthentication;nite
state model;physical security;operational environment;cryptographic key
management; electromagnetic interference/electromagnetic compatibility
(EMI/EMC); self-tests; design assurance; and mitigation of other attacks.
The standard provides users with a specication of security features that
are required at each of four security levels;exibility in choosing security
requirements;aguidetoensuringthatthecryptographicmodulesincorpo-
rate necessary security features; and the assurance that the modules are
compliantwithcryptography-basedstandards.
CSD continues to evaluate new technologies that impact cryptographic
security, and examines cryptographic standards every ve years for their
security capabilities.We are developing FIPS 140-3 to meet the new and
revised requirements of federal agencies for cryptographic systems, and
to address technological and economic changes that have occurred since
the issuance of FIPS 140-2. The development of FIPS 140-3 was started
in 2005. In July 2007, the rst draft of a future standard was released
for public comment. This draft standard proposed increasing the number
of security levels from four to ve. Many other improvements were intro-
duced,reecting the developing industry trends and our analysis of public
comments. The draft standard stipulated that the authentication require-
ments should be strengthened; that the software security should become
a separate new topic;that at higher levels of security,the module should
be protected against non-invasive attacks;and that there should be more
exibilityinhowtheself-testsareperformed. Thecommentperiod,which
endedonOctober11,2007,wasfollowedbyathoroughreviewandanalysis
ofallcomments.
InMarch2008,NISTheldaone-dayworkshoptodiscussthesoftwaresecurity
issuesassociatedwithFIPS140-3. Morethan70peoplerepresentingmany
software vendors participated in this event. The workshop participants
contributed many new comments in addition to those collected after the
rst draft of FIPS 140-3 was published.The second draft of the standard
iscurrentlyunderdevelopment. Itwillbemadeavailabletothepublicfor
comments,withthenalversionofthestandardexpectedtobeannounced
inlateFY2009. TheFIPS140-3standardwilltakeeffectsixmonthsafterthe
nalversionisapprovedbytheSecretaryofCommerce.
Contact:Dr.AllenRoginsky
(301)975-3603
allen.roginsky@nist.gov
18
2 0 0 8 A N N U A L R E P O R T

STRATEGIC GOAL4Develop and improve mechanisms to protect the integrity, condentiality, and authenticity of
Federal agency information by developing security mechanisms, standards, testing methods, and
supporting infrastructure requirements and methods.
SECURITY TECHNOLOGY GROUP (ST)
Overview
T
he CSD is continuing to make an impact in cryptography within
and outside the Federal government. Strong cryptography can be
used to improve the security of systems and the information that
they process.Information technology users benet from the availability of
secure applications of cryptography in the marketplace. Our work in this
area addresses such topics as hash functions, secret and public key cryp-
tographic techniques, authentication, cryptographic protocols, public key
certicate management, biometrics, and smart tokens.The impact of this
work is demonstrated by the changes in the way that users authenticate
theiridentitiesforon-linegovernmentservices,andinthedevelopmentof
newstandardsformobilewirelesskeyderivation. Thisworkalsosupports
theCSDsPersonalIdentityVerication(PIV)projectforHomelandSecurity
PresidentialDirective12(HSPD-12).
The CSD collaborates with national and international agencies and stan-
dardsbodiestodevelopsecure,interoperablesecuritystandardsandguide-
lines. Federal agency collaborators include the Department of Energy, the
DepartmentofState,theNationalSecurityAgency(NSA),andtheCommu-
nicationsSecurityEstablishmentofCanada.Nationalandinternationalstan-
dardsbodiesincludetheAmericanStandardsCommittee(ASC)X9(nancial
industrystandards),theInternationalOrganizationforStandardization(ISO),
theInstituteofElectricalandElectronicsEngineers(IEEE),theLibertyAlliance,
andtheInternetEngineeringTaskForce(IETF).Industrycollaboratorsinclude
Certicom, Entrust Technologies, InfoGard, Microsoft, NTRU, Orion Security,
RSASecurity,VoltageSecurity,Seagate,Cisco,andWellsFargo.
Cryptographic Standards Toolkit
Hash Functions
Ahashfunctionprocessesamessage,whichcanbeverylarge,andproduces
acondensedrepresentation, calledthemessagedigest. Acryptographichash
function is designed to achieve certain security properties and is typically
used with other cryptographic algorithms, such as digital signature algo-
rithms,keyderivationalgorithms,keyed-hashmessageauthenticationcodes,
orinthegenerationofrandomnumbers. Cryptographichashfunctionsare
frequentlyembeddedinInternetprotocolsorinotherapplications;thetwo
mostcommonlyusedcryptographichashfunctionsareMD5,whichhasbeen
frequentlybrokenbutwhichwasneverapprovedforfederalagencyuse,and
theNIST-approvedhashalgorithmSHA-1.
In2005,researchersfoundanattackmethodthatthreatenssecurityofthe
SHA-1hashalgorithm. Since2005researchersatNISTandelsewherehave
also discovered several generic limitations in the basic Merkle-Damgard
construct,usedbyMD5,SHA-1andmostotherexistinghashfunctions. To
addressthesethreats,NISTheldtwocryptographichashfunctionworkshops
to assess the status of NISTs approved hash functions and to discuss the
latest hash function research. NIST decided that it would be prudent to
developoneormoreadditionalhashfunctionsthroughapubliccompetition
similartotheprocessusedfortheAdvancedEncryptionStandard(AES). We
published draft minimum acceptability requirements, submission require-
ments,and evaluation criteria in the Federal Register on January 23,2007
forpubliccomment,andannouncedthecryptographichashcompetitionin
theFederalRegisteronNovember2,2007. Submissionsfornewhashalgo-
rithms were requested by October 31, 2008.The competition is expected
to take four years and we expect to complete an augmented Secure Hash
Standardin2012.
Twocryptographicstandardswererevisedduring2008:FIPS180-3,Secure
Hash Standard (SHS), and FIPS 198-1, The Keyed-Hash Message Authen-
tication Code (HMAC). FIPS 180-3 species ve cryptographic hash algo-
rithms,and FIPS 198-1 species a method of using a hash algorithm from
FIPS 180-3 to compute message authentication codes. In addition, two
Draft NIST Special Publications (SPs) were posted for public review and
comment: Draft SP 800-106, Randomized Hashing for Digital Signatures,
and Draft SP 800-107, Recommendation for Applications Using Approved
HashAlgorithms.The Draft SP 800-106 species a method to enhance the
security of the cryptographic hash functions used in certain digital signa-
tureapplicationsbyrandomizingthemessagesthataresigned.TheDraftSP
19
S E C U R I T Y T E C H N O L O G Y G R O U P ( S T ) S E C U R I T Y T E C H N O L O G Y G R O U P ( S T )

2 0 0 8 A N N U A L R E P O R T
800-107addressessecurityissuesrelatedtoapplicationsofapprovedhash
algorithmsandtheuseofHMACasspeciedinFIPS180-3andFIPS198-1
respectively;additionaltechnicaldetailsforusingthesestandardsarealso
providedintheDraftSP800-107.
Digital Signatures
InFY2008,workcontinuedondevelopingthedraftofFIPS186-3,arevision
oftheDigitalSignatureStandard(DSS).Thisrevisionincludesadditionalkey
sizes for the Digital Signature Algorithm (DSA) to provide higher security
strengths, and guidance on the use of RSA and the Elliptic Curve Digital
Signature Algorithm (ECDSA) to promote interoperability. The draft DSS
revisionwasissuedforpubliccommentin2006.Subsequentworktoaddress
thosecommentshasincludedanalysisoftheapprovedmethodsforRSAkey
pairgenerationandprimalitytesting.
Random Number Generation
Randomnumbersareneededbymostcryptographicapplicationsandalgo-
rithms.Forexample,randomnumbersareusedtogeneratethekeysneeded
for encryption and digital signature applications.NIST SP 800-90, Recom-
mendationforRandomNumberGenerationUsingDeterministicRandomBit
Generators (DRBGs),species approved deterministic methods for random
number generation. We have been working with Accredited Standards
Committee X9 (ASC X9) to provide guidance on entropy sources and the
constructionofRandomBitGeneratorsfromentropysourcesandDRBGs.
Block Cipher Modes of Operation
TheGalois/CounterMode(GCM),anewmodeofoperationoftheAdvanced
EncryptionStandard(AES)algorithmspeciedinSP800-38DRecommenda-
tionforBlockCipherModesofOperation: Galois/CounterMode(GCM)and
GMAC,wasapprovedinNovember2007. GCMbothencryptsandauthenti-
catesthedataitprotects. GCMisdesignedforhighthroughputinhardware
applications,suchashigh-speedInternetrouters.
InJune2008,webegana90-daypubliccommentperiodonaproposalto
approvetheXTS-AESmodeofoperationbasedonIEEEStandard1619-2007.
The XTS-AES mode is designed to encrypt data for storage applications,
without expansion of the data; it was submitted to NIST by the Chair of
the IEEE Security in StorageWorking Group. The public comments on the
modeweremixed;wearenowreviewingthecommentsandwewilldecide
whethertomoveforwardwiththeapprovalinaNISTspecialpublication.
We are also considering the Feistel Finite Set Encryption Mode (FFSEM),
anAESmodedesignedtoencryptsmallerblocksofdatainamannerthat
preservestheformatofthedata. Forexample,theencryptedformofasocial
securitynumberwoulditselfappeartobeasocialsecuritynumber. Conse-
quently,indatabaseapplications,theeldsofsensitiveinformationcouldbe
encrypted,withoutdisruptingthestructureofthedatabase;othereldsof
datacouldremainunencryptedtofacilitateanalysis.
Recommendation for Key Management
The requirements for key management continue to expand as new types
of devices and connectivity mechanisms become available (e.g., laptops,
broadband access,smart cell phones). We continue to address the needs
oftheFederalgovernmentbydeningthebasicprinciplesrequiredforkey
management, including key establishment, wireless applications, and the
PublicKeyInfrastructure(PKI).
SP 800-57, Recommendation for Key Management provides key manage-
mentguidance. Parts1and2ofSP800-57offergeneralguidanceandbest
practicesforthemanagementofcryptographickeyingmaterial. Part3ofSP
800-57 addresses application-specic guidance and will soon be available
forpubliccomment. ItincludesguidanceonusingaPublicKeyInfrastructure
(PKI); protocolssuchasIPsec(InternetProtocolSecurity), TLS(TransportLayer
Security),S/MIME(Secure/MultipartInternetMailExtensions),Kerberosand
OTAR (Over-the-Air Rekeying); and applications such as DNSSEC (Domain
NameSystemsSecurityExtensions)andEncryptedFileSystems.
Key Establishment using Public Key Cryptography
Keyestablishmentisaprocessthatresultsinsharedsecretkeyingmaterial
among different parties.NIST SP 800-56A, Recommendation for Pair-Wise
Key Establishment Schemes Using Discrete Logarithm Cryptography, was
completedin2006. Weexpecttoissueanadditionalpublication, SP800-56B,
Recommendation for Pair-Wise Key Establishment Schemes Using Integer
FactorizationCryptography(e.g.,RSA)forpublicreviewinFY2009.
Key Management for Wireless Applications
WirelessLocalAreaNetwork(LAN)andMetropolitanAreaNetwork(MAN)
technologies are being widely adopted by government agencies. While
wireless technologies can provide connections for mobile users, wireless
devices and networks are also vulnerable to various attacks. The Institute
ofElectricalandElectronicsEngineers(IEEE),theInternetEngineeringTask
Force (IETF),and other industry standards bodies have developed security
protocolsforwirelessnetworksandcommunications.
A new feature for many wireless services is a fasthandoffor transition
between different access points. Fast handoff poses a new challenge for
cryptographic key management. To make the handoff truly fast, crypto-
graphic keys are derived and distributed among different access points so
20
2 0 0 8 A N N U A L R E P O R T S E C U R I T Y T E C H N O L O G Y G R O U P ( S T )
S E C U R I T Y T E C H N O L O G Y G R O U P ( S T )
that whenever a mobile station is roaming to a different access point,the
keys are ready for a secure connection. A key hierarchy is derived from a
masterkeyforthefasthandoff.
The primary security concerns relate to key establishment among multiple
keyholders. Thisisfurthercomplicatedbecause,unlikeacellularsystem,a
mobileLANorMANstationdetermineswhentomakeatransitionfromone
accesspointtoanother. Thismakesitmoredifcultforthenetworktocoor-
dinatekeyestablishmentamongmultiplepartiesinasecuremanner.
In 2008, we completed draft NIST SP 800-108, Recommendation for Key
DerivationUsingPseudorandomFunctions,andrequestedpubliccomments
on the draft.The draft of SP 800-108 species three families of key deri-
vationfunctionsusingpseudorandomfunctions.Theyincorporatethemost
commonlyusedkeyderivationfunctionsinwirelessapplications.Weexpect
topublishSP800-108inFY2009afterthepubliccommentsareresolved.
Public Key Infrastructure
Wecontinuetosupportthedevelopmentandenhancementofkeymanage-
mentstandardsforPublicKeyInfrastructure(PKI).Twosignicantmilestones
inNISTsInternetEngineeringTaskForce(IETF)standardizationeffortswere
achieved in 2008.The Server-based Certicate Validation Protocol (SCVP)
waspublishedasRFC5055.SCVPspeciesaprotocolthatallowsthework
of validating certicates to be off-loaded to a delegated validation server.
ThethirdversionoftheInternetX.509PublicKeyInfrastructureCerticate
and Certicate Revocation List (CRL) Prole was published as RFC 5280.
ThisdocumentprolestheX.509standardforInternetuse,andisusedas
the basis for the development of most PKI products and the deployment
of PKIs in both the public and private sectors. CSD led the editing teams
for both of these documents. NIST has also contributed editors to three
companiondraftsforRFC5280. Thesedocumentsfocusonencodingrules
forpublickeysanddigitalsignaturesforsomeofthemoreadvancedNIST-
approvedalgorithms(e.g.,ellipticcurvesanddigitalsignatureswithrobust
paddingschemes). Inadditiontothesedocuments,CSDwillbeorganizing
the interoperability report for RFC 5280,which is needed to progress this
versiontoDraftStandard.
In addition to PKI standards,CSD has long assumed a leading role in the
deploymentofarobustandcomprehensiveFederalPKI(FPKI).Oureffortsin
2008focusedonFPKIinitiativesthatsupportthedeploymentandmanage-
mentofPersonalIdentityVericationCards(i.e.,FIPS201PersonalIdentity
Verication(PIV)ofFederalEmployeesandContractors). Sinceotheraspects
oftheFPKIhaveenteredamaintenancephase,wearetakingalessactive
role. NISTremainsamemberoftheFPKIPolicyAuthority,whichmanages
the Federal Bridge Certication Authority (FBCA) and the Common Policy
RootCerticationAuthority,andmaintainstheFPKIpolicies. NISTalsomain-
tains the FPKI certicate and CRL proles that specify the contents of all
FPKIX.509certicatesandCRLsusedintheFederalPKIasasubsetofthe
featuresinRFC5280.
Contacts:
HashFunctions FIPS180-3&198-1,SP800-106&107
Ms.Shu-jenChang Mr.QuynhDang
(301)975-2940 (301)975-3610
shu-jen.chang@nist.gov qdang@nist.gov
DigitalSignatures,RNG,KeyMgmt. PKI
Ms.ElaineBarker Mr.WilliamPolk
(301)975-2911 (301)975-3348
ebarker@nist.gov william.polk@nist.gov
BlockCipherModes WirelessKeyMgmt.
Dr.MorrisDworkin Dr.LilyChen
(301)975-2354 (301)975-6974
moris.dworkin@nist.gov lily.chen@nist.gov
Dr.DavidCooper(PKI)
(301)975-3194
david.cooper@nist.gov
Quantum Computing
Quantum computing has the potential to become a major disruptive tech-
nologyaffectingcryptographyandcryptanalysis. Whileascalablequantum
computing architecture has not been built, the physics and mathematics
governingwhatcanbedonebyaquantumcomputerarefairlywellunder-
stood, and several algorithms have already been written for a quantum
computing platform.Two of these algorithms are specically applicable to
cryptanalysis. Groversquantumalgorithmfordatabasesearchpotentially
givesaquadraticspeeduptobruteforcecryptanalysisofblockciphersand
hash functions. Grovers algorithm may therefore have a long-term effect
onthenecessarykeylengthsanddigestsizesrequiredforthesecureopera-
tionofcryptographicprotocols.AnevenlargerthreatispresentedbyShors
quantum algorithms for discrete logarithms and factorization. Given a
quantum computer large enough to perform simple cryptographic opera-
tions, Shors algorithm provides a practical computational mechanism for
solvingthetwoostensiblyhardproblemsthatunderlieallwidelyusedpublic
keycryptographicprimitives.Inparticular,allthedigitalsignaturealgorithms
andpublickey-basedkeyestablishmentschemesthatarecurrentlyapproved
byNISTwouldberenderedinsecurebythepresenceofevenafairlyprimitive
quantumcomputer.
While practical quantum computers are not expected to be built in the next
decadeorso,itseemsinevitablethattheywilleventuallybebuilt.CSDhopes
to plan for this eventuality by adding primitives to the cryptographic toolkit
forpublickey-basedkeyagreementanddigitalsignaturesthatarenotsuscep-
tibletocryptanalysisbyquantumalgorithms.Intheeventthatsuchalgorithms
21
2 0 0 8 A N N U A L R E P O R T
cannotbefound,Weintendtodraftstandardsforcomputersecurityarchitec-
tures that do not rely on public key cryptographic primitives.In addition,We
willalsoexaminenewapproaches,suchasquantumkeydistribution.
DuringFY2008,weparticipatedinanumberofconferencesandmeetingson
quantumcomputingandquantumkeydistribution:theUpdatingQuantum
CryptographyconferenceinJapan;anARO/NSA/DTOQuantumComputing/
QuantumAlgorithms program review;and a meeting about possible stan-
dardsforquantumkeydistributionsystems.Inaddition,wearecontinuingto
meetwithmembersoftheAdvancedNetworkTechnologyDivisiontodiscuss
thenetworklayerimplicationsofquantumkeydistribution.
During FY2009, we will continue to study security technologies that may
be resistant to attack by quantum computers, especially those that have
generatedsomedegreeofcommercialimpact.Ifanyofthesetechnologies
emergesasbothcommerciallyviableandwidelytrustedwithinthecrypto-
graphiccommunity,wehopetomovetowardsstandardization.
Contact:Mr.RayPerlner
(301)975-3357
ray.perlner@nist.gov
Authentication
In FY2008,we completed a draft update of SP 800-63,ElectronicAuthen-
tication Guideline, and requested public comments. SP 800-63 supports
the Ofce of Management and Budget (OMB) memorandum M-04-04,
E-Authentication Guidance for Federal Agencies. The OMB policy memo-
randum denes four levels of authentication in terms of assurance about
thevalidityofanassertedidentity. SP800-63givestechnicalrequirements
and example authentication technologies that work by making individuals
demonstratepossessionandcontrolofasecretforeachofthefourlevels.
ThedraftpublicationupdatedSP800-63toaddressadditionalauthentication
mechanismsthatarenowavailableinthemarketplace.Extensivecomments
werereceivedthatreecttheextenttowhichSP800-63hasbeenadopted
bymanynon-federalusersandindicateanumberofapplicationsthatwere
not anticipated in the original version of SP 800-63 or in the draft. The
mostdifcultissuesinvolveproposednewmethodsforreachinglevel4,the
highestauthenticationlevel,withcurrenttechnologies. Weexpecttoissue
thenalupdatedversionofSP800-63inFY2009.
Contacts:Mr.WilliamBurr Mr.RayPerlner
(301)975-2934 (301)975-3357
william.burr@nist.gov ray.perlner@nist.gov
Security Aspects of Electronic Voting
In2002,CongresspassedtheHelpAmericaVote
Act(HAVA)toencouragetheupgradeofvoting
equipment across the United States. HAVA
established the ElectionAssistance Commission
(EAC)andtheTechnicalGuidelinesDevelopment
Committee (TGDC), chaired by the Director of
NIST. HAVA calls on NIST to provide technical
supporttotheEACandTGDCineffortsrelatedtohumanfactors,security,
and laboratory accreditation.To explore and research issues related to the
security and transparency of voting systems, the TGDC established the
SecurityandTransparencySubcommittee(STS).AspartofNISTseffortsled
bytheSoftwareandSystemsDivision,CSDsupportstheactivitiesoftheEAC,
TGDC,andSTSrelatedtovotingequipmentsecurity.
From2006to2007wesupportedtheTGDCinthenaldevelopmentofthe
VoluntaryVotingSystemGuidelines(VVSG). Inthepastyear,wedeveloped
aninitialdraftofatestsuiteforthesecurityrequirementsoftheVVSGand
initiatedreviewsofthedrafttestsuite. AttherequestoftheEAC,weinves-
tigatedalternativemeansofachievingvotingsystemauditabilitybeyondthe
SoftwareIndependenceapproach,inordertoencourageinnovationinvoting
systems. WeconductedresearchintothesecurityramicationsofBallot-on-
Demand and Vote-By-Phone technologies. In addition, we supported the
EACseffortstoimprovethevotingprocessforcitizensundertheUniformed
and Overseas CitizensVotingAct (UOCAVA) by leveraging electronic tech-
nologies.
InFY2009wewillsupporttheEACwithresolutionofpubliccommentson
theVVSGrecommendations. Wewillconductanexternalreviewofthetest
suiteforthesecurityrequirementsintheVVSGrecommendations. Weplan
to update theVVSG security requirements and the test suite based on the
commentsfromthesereviews.WewillcontinuetoassisttheEAConresearch
efforts,suchasUOCAVAvoting,alternativestoSoftwareIndependence,and
threatstovotingsystems.WewillsupporttheNISTNationalVoluntaryLabo-
ratoryAccreditationProgram(NVLAP)accreditationeffortsofvotingsystem
testlaboratories,hosttheTGDCplenarymeetings,andsupportSTSactivities.
Weplantoengagevotingsystemmanufacturers,votingsystemtestlabora-
tories,stateelectionofcials,andtheacademiccommunitytoexploreways
toincreasevotingsystemsecurityandtransparency.
http://vote.nist.gov/
Contacts:Dr.NelsonHastings Mr.AndrewRegenscheid
(301)975-5237 (301)975-5155
nelson.hastings@nist.gov andrew.regenscheid@nist.gov
22
2 0 0 8 A N N U A L R E P O R T

STRATEGIC GOAL4Devise advanced security methods, tools, and guidelines through conducting near-term and
midterm security research.
SYSTEMS AND NETWORK
SECURITY GROUP (SNS)
Overview Identity Management Systems
I
n our security research,we focus on identifying emerging technologies
and developing new security solutions that will have a high impact on
the critical information infrastructure. We perform research and devel-
opment on behalf of government and industry from the earliest stages of
technologydevelopmentthroughproof-of-concept,referenceandprototype
implementations,anddemonstrations. Weworktotransfernewtechnolo-
giestoindustry,toproducenewstandards,andtodeveloptests,testmeth-
odologies,andassurancemethods.
Tokeeppacewiththerateofchangeinemergingtechnologies,weconduct
alargeamountofresearchinexistingandemergingtechnologyareas. Some
ofthemanytopicsweresearchincludesmartcardinfrastructureandsecurity,
wirelessandmobiledevicesecurity,VoiceoverInternetProtocol(IP)security
issues,digitalforensicstoolsandmethods,accesscontrolandauthorization
management,IPsecurity,intrusiondetectionsystems,quantuminformation
systemsecurityandquantumcryptography,andvulnerabilityanalysis. Our
researchhelpstofulllspecicneedsbythefederalgovernmentthatwould
notbeeasilyorreliablylledotherwise.
Wecollaborateextensivelywithgovernment,academia,andprivatesector
entities. In the past year, this included the National SecurityAgency, the
DepartmentofDefense,theDefenseAdvancedResearchProjectsAgency,the
Department of Justice, the University of Maryland, George Mason Univer-
sity, Rutgers University, Purdue University, George Washington University,
the University of Maryland-Baltimore County, Columbia University, Micro-
softCorporation,SunMicrosystems,theBoeingCompany,IntelCorporation,
LucentTechnologies,OracleCorporation,andMITRE.
Personal Identity Verication
In response to Homeland Security Presidential Directive 12 (HSPD-12),
FederalInformationProcessingStandard(FIPS)201,PersonalIdentityVeri-
cation(PIV)ofFederalEmployeesandContractors,wasdevelopedandwas
approvedbytheSecretaryofCommerceinFebruary2005. HSPD-12callsfor
thecreationofanewidentitycredentialforFederalemployeesandcontrac-
tors.FIPS201isthetechnicalspecicationofthenewidentitycredentialand
thePIVSystemthatproduces,manages,andusesthecredential. Therelease
of FIPS 201 marked the beginning of a learn-design-develop-test-validate
phase for both HSPD-12 product suppliers and Federal departments and
agencies. Duringthisphase,over300standard-conformantproductswere
developed,validated,andbroughttomarket,anddepartmentsandagencies
developedandrenedtheirPIVissuanceprocesses. Byearly2008,produc-
tion PIV issuance systems were operating, and the emphasis had shifted
tohigh-volumeenrollmentofFederalemployeesandcontractorsinthePIV
System. ByOctober2008,approximately250,000Federalemployeeshave
beensponsoredtotheGeneralServicesAdministrationPIVissuancesystem
alone;severalagencieshaveachievedissuanceto50%ofemployees;and
someagenciesareexpectedtoreach90-95%enrollmentinthenearfuture.
CSD activities in 2008 related to the FIPS 201 standard directly supported
the increase in operational use of the identity credential. To achieve this
levelofuse,
PrioritywasgiventorequestsforassistancefromFederaldepartments
andagenciesandtheirsuppliers;
To maintain the stability of the technical standard, FIPS 201-1, the
provisionsofChangeNotice1(ineffect)werekeptineffect.
Modications to the supporting Special Publications were limited to
thosecommittedandscheduledinpreviousyears,asmallnumberof
necessary,backward-compatible process and technical improvements
(detailedbelow),andeditorialimprovementsforclarity;
23
S Y S T E M S A N D N E T W O R K S E C U R I T Y G R O U P ( S N S ) S Y S T E M S A N D N E T W O R K S E C U R I T Y G R O U P ( S N S )
2 0 0 8 A N N U A L R E P O R T
Effort was devoted to the application of issued PIV credentials, in
particular,to PhysicalAccess Control Systems (PACS),and download-
ablesoftwarepackages,usefulasdemonstrationsofPIVandtutorials
forproductdevelopers.
WiththereleaseofNISTSpecialPublication(SP)800-78, CryptographicAlgo-
rithmsandKeySizesforPersonalIdentityVerication,in2005,andcontinuing
withthereleaseofNISTSP800-78-1CryptographicAlgorithmsandKeySizes
forPersonalIdentityVerication in2007,dateswereestablishedfordiscon-
tinuingtheuseofcertaincryptographicalgorithmsinthePIVSystemandPIV
Cards(specically,RSA1024,SHA-1,and2TDEA). Thisactionwasnecessary
toensureadequatecryptographicstrengthforPIVapplications. Theuseof
higherstrengthcryptographicalgorithmswasenabledbySP800-78-1,but
sincecorrespondingchangeswereneededinthePIVCardtechnicalspeci-
cation,arevisionofNISTSP800-73-2,InterfacesforPersonalIdentityVeri-
cation,was released in 2008. NIST SP 800-73-2 enabled the use of RSA
2048, SHA-256, and Elliptic Curve algorithms to replace those algorithms
that were discontinued. SP 800-73-2 otherwise maintains strict backward
compatibility with SP 800-73-1. Two optional features were added to the
technicalspecication: anon-cardDiscoveryObjectandamiddlewareentry
point "PIVMiddlewareVersion," to resolve specic implementation issues.
SP800-73-2wasalsoorganizedinfourparts,foreaseofuseandmainte-
nance,andincorporatesmanyeditorialimprovements.
The public comment periods on NIST SP 800-73-2 elicited many valuable
suggestions from Federal departments and agencies and industry for PIV
System and PIV Card enhancements. Two of these,encryption key history
management and biometric Match-On-Card, were strongly supported by
DepartmentofState,DepartmentofHomelandSecurity,andDepartmentof
Defense. We are evaluating these issues for future PIV System enhance-
ments and possible inclusion in future revisions of FIPS 201-1 and the
relevantSpecialPublications.
NISTSP800-79-1,GuidelinesfortheAccreditationofPersonalIdentityVeri-
cation(PIV)CardIssuers(PCI's),wasreleasedin2008. Whiletheoriginal
version,SP800-79,waswrittenbeforeanyoperatingPIVSystemhadbeen
accredited, SP 800-79-1 incorporates experience from multiple implemen-
tations and successful Certication & Accreditation activities by several
agencies. Substantial improvements include: business models (in-house,
leased, shared, etc.) for PIV Card Issuers (PCI); lessons learned from past
accreditations;andtheeffectofrecentOMBMemoranda.Themostsigni-
cantchangesarethereplacementofAttributeswithanobjectivesetofPCI
controls,and an assessment and accreditation methodology that assesses
thecapabilityandreliabilityofaPCIbasedonthesecontrols. Specicallythe
accreditationmethodologyconsistsofthefollowingsteps:
Derivation of PCI controls based on requirements in FIPS 201-1 and
supportingdocuments,OMBMemoranda,etc.;
ProvidingacontextforPCIcontrolsbyidentifyingasetofhierarchical
conceptssuchasPCIAccreditationTopicsandPCIAccreditationFocus
Areas;
DevelopmentofassessmentmethodsappropriateforeachPCIcontrol
thatwillassessconformancetothoseunderlyingrequirements;and
Guidanceforevaluatingtheresultsofassessmentsinordertoarriveat
anaccreditationdecision.
Draft NIST SP 800-116, A Recommendation for the Use of PIV Creden-
tials in PhysicalAccess Control Systems (PACS) was released for a second
public comment period,and is expected to be issued after we review and
resolve the comments received. Draft SP 800-116 is an application note
that explains how the FIPS 201-1 standard, and the PIV System and PIV
Cards that it describes, should be used to perform subject authentication
in Physical Access Control Systems (PACS). The publication explains the
visionforPIVSystemimplementation,thecriteriaforjudgingprogressand
completion, and the benets that can be produced by a complete imple-
mentation. Itexplainsa simplefacility securitymodel (rst described ina
widely-referencedArmyphysicalsecurityhandbook),andrecommendshow
PIV Card authentication mechanisms should be selected and implemented
at perimeter and interior access points. CSD gratefully acknowledges the
contributionstothedevelopmentofthepublicationbytwenty-twoFederal
employees with expertise across the disciplines required and the facilities
beingprotected.
On1May2008,duringtherstpubliccommentperiodforDraftSP800-116,
a workshop was held at NIST in Gaithersburg on the integration of PIV
credentials with PhysicalAccess Control Systems. Seventy PACS suppliers
and users participated in the workshop,and the lively discussion resulted
24
2 0 0 8 A N N U A L R E P O R T S Y S T E M S A N D N E T W O R K S E C U R I T Y G R O U P ( S N S )
S Y S T E M S A N D N E T W O R K S E C U R I T Y G R O U P ( S N S )
inimportantimprovementsandadditionstoDraftSP800-116. Theauthors
thanktheworkshopparticipantsfortheirmanycontributions.
AswithourexperienceinthedevelopmentofNISTSP800-73-2,comments
onDraftSP800-116havestimulatedR&Dactivitiesthatcouldleadtofuture
standardsimprovements. Wehavedraftedaresearchpaper,SymmetricKey
Injection onto Smart Cards, describing new approaches to symmetric key
managementonsmartcards,andfourcryptographicprotocolsthatcouldbe
usedtoimplementthem. NISTisaparticipantinthePhysicalAccessInter-
agencyInteroperabilityWorkingGroup(PAIIWG)oftheGovernmentSmart
Card-Interagency Advisory Board (GSC-IAB), where security engineering
principlesforsymmetrickeymanagementinPhysicalAccessControlSystems
areunderdiscussion.
NISTInteragencyReport(IR)7452,SecureBiometricMatch-On-CardFeasi-
bilityReport waspublishedin2008. Thisstudyexploresthetechnicalfeasi-
bility of biometric ngerprint matching performed on a smart card. NIST
speciedthefeasibilitycriteriaandtestconditions,invitedindustryparticipa-
tion,andreportedonthesuccessfultestresults. Anespeciallychallenging
condition was the requirement that all communication of biometric data
betweenthesmartcardandcardreaderbeencrypted,andthatallcommu-
nicationofsmartcardassertionstothecardreaderbeauthenticatable. At
theconclusionofthestudyperiod,fourcompanieshadsubmittedseventeen
test congurations resulting in successful tests. The performance criterion
of match completion in less than 2.5 seconds was met by all seventeen
congurations, an important milestone in the evolution of authentication
technology. In parallel with the study underlying NISTIR 7452, the NIST
Information Access Division completed NISTIR 7477, a companion study
demonstrating that biometric Match-On-Card algorithms can meet the
accuracycriteriaestablishedbytheMinutiaeInteroperabilityExchangeTest
(MINEX)testing.
NIST published two software packages in 2008 that demonstrate PIV in
action: PartialCSPSoftware,apartialimplementationofaWindows2000
Cryptographic Service Provider (CSP), that demonstrates the use of a PIV
CardtologontoWindows2000;and"PKCS#11Software,"animplemen-
tation of a Public Key Cryptography Standard #11 cryptographic module,
thatdemonstratestheuseofaPIVCardtoauthenticationSSL/TLSsessions
with Firefox, and to sign/verify and encrypt/decrypt email messages with
Thunderbird,onFedoraCoreLinux. Thesesoftwarepackagescanbedown-
loadedwithoutcostfromtheCSDwebsite,http://csrc.nist.gov.(Note: these
packagesaredemonstrations,arelimitedinfunction,havenotbeentested
andvalidatedforusebyFederalagenciesordepartments,andareprovided
withoutsupport;theyarenotsuitableasalternativestocommercialsoftware
products.) A third demonstration package,featuring biometric enrollment
andauthentication,iscurrentlyunderdevelopment.
NIST responds to many questions relating to HSPD-12, FIPS 201-1, and
PersonalIdentityVericationeachmonth. QuestionsoriginatefromtheOMB
HSPD-12SupportTeam,theFederalIdentity&CredentialingCommittee,the
Government Smart Card-Interagency Advisory Board (GSC-IAB), Executive
Branchdepartmentsandagencies,LegislativeBranchofces,themedia,the
technology industry,and concerned citizens. Whenever possible,we try to
answerquestionsimmediately.Sometimes,thequestionsmotivatenewtasks
withlargerconsequences. In2008,forexample,technicalquestionsabout
thevalidationofPIVCardsmotivatedthedescriptionandinitiationofatask
entitled"PIVCardTrustValidationProcedure,"tospecifytheexacttechnical
proceduredepartmentsandagenciesshouldusetovalidatethetrustworthi-
ness of a PIV Card. Occasionally, new questions are received concerning
publications that are not currently under revision. These questions will be
consideredwhentherelevantpublicationsareselectedforrevision.
NIST will review FIPS 201-1 by February 2010 to assess its adequacy and
ability to adapt to advancements and innovations in science and tech-
nology.
http://csrc.nist.gov/groups/SNS/piv
Contacts:Mr.WilliamI.MacGregor Ms.HildegardFerraiolo
(301)975-8721 (301)975-6972
william.macgregor@nist.gov hildegard.ferraiolo@nist.gov
NIST Personal Identity Verication Program (NPIVP)
The objective of the NIST Personal IdentityVerication Program (NPIVP) is
to validate Personal IdentityVerication (PIV) components as required by
FederalInformationProcessingStandard(FIPS)201PersonalIdentityVeri-
cation(PIV)ofFederalEmployeesandContractors forconformancetospeci-
cations in the FIPS 201 companion document SP 800-73-1,Interfaces for
PersonalIdentityVerication.ThetwoPIVcomponentsthatcomeunderthe
scopeofNPIVParePIVSmartCardApplicationandPIVMiddleware.Allof
thetestsunderNPIVPareconductedbythird-partytestfacilities,whichare
accreditedasCryptographicModuleTest(CMT)laboratoriesbytheNational
Voluntary Laboratory Accreditation Program (NVLAP). These laboratories
have extended the scope of testing to include PIV Smart Card application
andPIVMiddlewaretestmethods,andarecalledaccreditedNPIVPtestfacil-
ities.AsofSeptember2008,thereweretenaccreditedNPIVPtestfacilities.
TofacilitatedevelopmentofPIVSmartCardApplicationandPIVMiddleware
forconformancetointerfacespecicationsinSP800-73-1,NPIVPpublished
SP800-85A,PIVCardApplicationandMiddlewareInterfaceTestGuidelines.
Inadditiontothetests,thisdocumentalsoprovidesaninterpretationofSP
800-73-1specicationsthroughpublicationofC-languagebindingsforPIV
Middleware interface commands as well as detailed mapping of PIV Card
CommandInterfacereturncodestoPIVMiddlewareInterfacereturncodes.
25

2 0 0 8 A N N U A L R E P O R T
WealsodevelopedanintegratedtoolkitcalledPIVInterfaceTestRunner
for conducting tests on both PIV Card Application and PIV Middleware
products,andprovidedthetoolkittoaccreditedNPIVPtestfacilities.
InFY2008,sixPIVCardapplicationproductswerevalidatedandcerticates
issued, bringing the total number of NPIVP-validated PIV Card applica-
tion products to 15. In addition,two PIV Card application products were
revalidated after the vendors made changes to the products for efciency
reasonsandforstoragescalability.NineNPIVP-validatedPIVCardapplica-
tionproductspassedtheFIPS140-2SecurityRequirementsforCryptographic
Modules validation,bringingthetotalnumberofFIPS140-2andNPIVP-vali-
datedPIVCardapplicationproductstoeleven.InadditiontoPIVCardappli-
cationproductsvalidation,NPIVPvalidatedthreePIVMiddlewareproducts,
bringing the total number of NPIVP-validated PIV Middleware products to
ten.
TofacilitatetestingofcredentialdataonPIVCardsforconformancetothe
data model specications inAppendixA of SP 800-73-1,NPIVP published
SP800-85B,PIVDataModelTestGuidelines,anddevelopedanassociated
toolkit,PIV Data Model Test Runner. In order to enable the toolkit to
beusedforsupportingtheGSAsFIPS201EvaluationProgramsElectronic
PersonalizationProductcertication,NPIVPmadeseveralenhancementsto
thePIVDataModelTestRunner,includingreportingcapabilities.NPIVPalso
enhanced the PIV Data ModelTest Runner to include the functionality to
generatemultiplesampledatasetsinadditiontothefeatureforpopulating
aPIVCardwithadataset.TofacilitatedevelopmentofconformantPersonal
IdentityVerication(PIV)productsbyvendors,NPIVPalsomadethePIVData
ModelTest Runner available for download from the NISTWeb site.As of
September 24,2008,163 vendors/system integrators had downloaded the
PIVDataModelTestRunner.
InSeptember2008,wereleasedSP800-73-2,InterfacesforPersonalIdentity
Verication.ThefourpartsthatcompriseSP800-73-2supersedethesingle
document SP 800-73-1, published in April 2006. While SP 800-73-2 was
nalized,NPIVP identied the necessary updates for the PIV InterfaceTest
Runner to align with SP 800-73-2 and SP 800-78-1, Cryptographic Algo-
rithmsandKeySizesforPersonalIdentityVerication.Inthefuture,NPIVP
TestLaboratorywillusetheupdatedPIVInterfaceTestRunnerforevaluating
newPIVCardapplicationandPIVMiddlewareproducts.
http://csrc.nist.gov/groups/SNS/piv/npivp
Contacts:Dr.RamaswamyChandramouli Ms.HildegardFerraiolo
(301)975-5013 (301)975-6972
chandramouli@nist.gov hildegard.ferraiolo@nist.gov
Conformance Tests for Transportation Worker Identication
Credential (TWIC) Specications
The TWIC Reader Hardware and Card Application Specication document
wasdevelopedbytheTransportationWorkerIdenticationCredential(TWIC)
Working Group (TWG) set up by the National Maritime Security Advisory
Committee(NMSAC). Thiscommitteewassetupundertheprovisionsofthe
MaritimeTransportationSecurityAct(MTSA),andisajointinitiativeofTrans-
portationSecurityAdministration(TSA)andUnitedStatesCoastGuard,both
organizationsunderDHS.TWICisacommonidenticationcredentialforall
personnel requiring unescorted access to secure areas of MTSA-regulated
facilities and vessels,and all mariners holding Coast Guard-issued creden-
tials. TSAwillissueworkersatamper-resistantSmartCardcontainingthe
workersbiometric(ngerprinttemplate)toallowforapositivelinkbetween
thecarditselfandtheindividual.
InordertofacilitatecommercialdevelopmentofSmartCardsandCredential
data for conformance to theTWIC Reader Hardware and CardApplication
Specication,theDHSDirectorateofScienceandTechnologys(S&T)Ofce
of Standards and Certication approached NIST to develop conformance
tests.In FY2008,NIST completed the development of theTWIC Interface
and Data ModelTest Runnerconsisting of a suite of 102 tests under the
followingcategories:
TWICCardApplicationInterfaceConformanceTests
TWICDataModelConformanceTests
TheDataModelConformanceTestsvalidateconformanceofdatapresentin
boththeSmartCardchipaswellasintheMagneticStripe.Followingvalida-
tionofthetestsbyrunningthemagainstasampleTWICcardproducedby
TSA,NISTsuggestedenhancementstothetestrunnerintheformofaddi-
tionaltests.FollowingapprovaloffundingfromtheDHSS&TDirectoratefor
thisproposal,NISThasinitiateddevelopmentoftheseadditionaltestsinthe
testrunner.Inaddition,NISTalsosuggestedimprovementstothespecica-
tions to remove ambiguities in interpretation and to facilitate precise test
outcomes.
Contact:Dr.RamaswamyChandramouli
(301)975-5013
chandramouli@nist.gov
26
Global eID
A very large number of large-scale identity management systems (IDMSs)
arebeingdevelopedanddeployedworldwide. Thetechnologiessupporting
these systems are also being developed globally. While many standards
bodies,such as ISO (International Standards Organization),are covered by
otherareasofCSD,thereareanumberofnon-standardsbodiessuchas
the Porvo Group, the International Telecommunication Union, the Asian
IdenticationCardForum,theOrganisationforEconomicCooperationand
Development, and the Global Collaboration Forummeeting and moving
forwardwithdevelopments.
Itisdifculttocomparetheselarge-scaleIDMSsthatarebeingdevelopedand
deployed,and to identify trends,locate potential interoperability issues,or
developmetricsforthem. Frequently,currentinformationaboutlarge-scale
IDMSsispresentedinveryinconsistent,oftenconfusingformats. Particulars
aboutthesystemstechnical,operational,policy-relatedarehaphazardly
presented and discussed,leaving many unanswerable questions. To date,
there has been no known attempt to ll in the gaps and to present the
informationaboutthesesystemsinaconsistentformatthatwouldenable
research,trendanalysis,andthedevelopmentofmetrics.
Theprincipallong-termgoaloftheeIDprojectistohelpkeeppartsofNIST,
aswellaspertinentUSGagencies,wellinformedofnon-standardsactivities
intheidentitymanagementrealmoutsideoftheUnitedStatesborders.
Anothergoalistoassemblealargeenoughstoreofinformationaboutlarge-
scaleIDMSssothatseverallaterprojectswillbecomemoreviable.Thiswork
willbeaLandscapeofIDMSs. OneprojectthatwillbenetfromthisLand-
scapeisthedevelopmentofcommonmodelsofIDMSs.Anotheristhedevel-
opmentofmetricsforIDMSs. Trendanalysesandidenticationofbarriers
tointeroperabilityofthesesystemswillalsobeenabledbyhavingthislarge
amountofdataonvarioussystemsinaconsistentformat.
TheinitialframeworkforthisLandscapeofIDMSshasbeendeveloped,and
datacollectionhasbeenstarted. ThisLandscapewillonlycollectinforma-
tion that is publicly available, and will work closely with representatives
world-widetoverifythisinformation. TheLandscapewillalsobeincluded
as collaborative work with the Permanent eID Status Observatory (PESO),
which is also currently under development. A presentation on the Land-
scapeworkwasgivenattheWorldeID2008ConferenceinSophia-Antipolis,
France,inSeptember2008.
http://www.itl.nist.gov/ITLPrograms/IDMS/external/Global_eID.html
Contact:Ms.TanyaBrewer
(301)975-4534
tbrewer@nist.gov
Identity Credential Smart Card Interoperability: ISO/IEC 24727
Identication Cards-Integrated Circuit Cards Programming
Interfaces
With the emergence of Homeland Security Presidential Directive 12 (HSPD
12)andtherespectivemandateforagovernmentwidestandardforsecure
and reliable forms of identication for federal government employees and
contractors,theuseofsmartcardswillincrease,bothinprivateandpublic
sectors,aswillsmartcard-basedtransactionsandapplications.
27

2 0 0 8 A N N U A L R E P O R T
Accordingtorecentreports,identitytheftcontinuestobeagrowingproblem
and is considered the number one cyber threat by many experts.The use
ofsolutionsthatprovidesecureandstronglyauthenticatedidentitycreden-
tials is increasingly important for safeguarding personal information and
protecting the integrity of IT systems. Smart cards coupled with security
protectionsprovidethenecessaryelementsofsuchasolution. Theyprovide
cryptographic mechanisms, store biometrics and keys, and, using certain
techniques, address privacy considerations. Technological solutions for
increasedsecurityofidentitycredentialsimprovetheabilityoftheconsumer
toprotectassetsandinformaticsprivacy.
Until recently, existing United States and international identication and
smartcardstandardslackedstandardizedapplicationinterfacesandsecurity
mechanisms. Large-scale use of smart cards within the United States had
laggeddespitethepotentialbenetsbecauseoftheinteroperabilitylimita-
tions. TheISO/IEC24727suiteofstandardsprovidesforthedevelopmentof
formalstandardsforsmartcardinteroperabilityandsecurityschemes.
DuringFY2008,wecontinuedthedevelopmentofISO/IEC24727,Identica-
tionCardsIntegratedCircuitCardsProgrammingInterfaces,themultipart
standard resolving current voids and interoperability challenges found in
existingstandards.
This suite of standards established the architecture required to develop
secureandinteroperableframeworksforintegratedcircuitcardtechnology
andidentitycredentials. Itenablesinteroperableandinterchangeablesmart
card systems and eliminates consumer reliance on proprietary-based solu-
tionsthathavebeenhistoricallyinherentinthisindustry. Existingstandards
providetheconsumerwithasolution,butthesestandardsofferaplethora
of options, making it very difcult, almost impossible, to ensure seamless
interoperability. Furtheringthedevelopmentofformallyrecognizedinterna-
tionalstandardsthroughcollaborativeeffortswithpublicandprivatesectors
willsupportorganizationsinprovidinganinteroperableandsecuremethod
for interagency use of smart card technology, in particular for identity
managementactivities.
ISO/IEC 24727 provides a set of programming interfaces for interactions
between integrated circuit cards (ICCs) and applications to include multi-
sectoruseofgenericservicesforidentication,authentication,andsignature.
ISO/IEC 24727 is specically relevant to identity management applications
thatrequiresecuretransactionsandinteroperabilityamongdiverseapplica-
tiondomains. Thisstandarddenesinterfacessuchthatindependentimple-
mentationsareinteroperable. Cardapplicationandassociatedservicesare
discoverable without reliance on proprietary information. This multi-part
standard will allow conformant interfaces devices,such as reader devices,
to read and interact with most if not all identity cards. It consists of the
followingparts:
ISO/IEC24727-1IdenticationcardsIntegratedcircuitcard
programminginterfacesPart1:Architecture
ISO/IEC24727-1speciestheframeworkandsupportingmecha-
nismsandinterfaces.Itprovidesessentialbackgroundinforma-
tionforthesubsequentparts.
programminginterfacesPart2:Genericcardinterface
ISO/IEC24727-2detailsthefunctionalityandrelatedinforma-
tionstructuresavailabletotheimplementationoftheapplication
interfacedenedinISO/IEC24727-3. Itprovidesagenericcard
interface.
programminginterfacesPart3:Applicationinterface
ISO/IEC24727-3detailsserviceaccessmechanismsforusebyany
application to include authentication protocols that are in use by
identitysystems(e.g., personalidenticationnumber[PIN], biometric,
symmetric key). It provides a common application programming
interface(API)andinteroperableauthenticationprotocols,therst
tobestandardizedbyastandards-settinggroup.
ISO/IEC 24727-4 Identication cards Integrated circuit card
programminginterfacesPart4:APIadministration
ISO/IEC24727-4detailsthesecuritymodelandinterfaceforsecure
messaging within the framework. It providesAPI administration
betweenPart2andPart3,andastandardAPIforinterfacedevices
(cardreaders).
ISO/IEC CD 24727-5 Identication cards Integrated circuit card
programminginterfacesPart5:Testing
ISO/IEC24727-5containsconformancetestingrequirements.
ISO/IEC CD 24727-6 Identication cards Integrated circuit card
programming interfaces Part 6: Registration procedures for the
authenticationprotocolsforinteroperability
ISO/IEC 24727-6 outlines the registration process for ISO/IEC
24727 authentication protocols and for registering use of ISO/IEC
24727usingaregistrationauthority. Usingaregistrationauthority
prevents the need to amend the standard when new authentica-
tion protocols are introduced for ISO/IEC 24727-3. Standards
Australia International has the contract with ISO for this registra-
tionauthority.
28

As of September 30, 2008, ISO/IEC 24727-1, ISO/IEC 24727-2, and ISO/
IEC 24727-4 were nal and available for purchase. ISO/IEC 24727-3 was
expectedtobeavailableinthenearfuture.ISO/IEC24727-5isacommittee
draft,withananticipatedpublisheddateinlate2009. ISO/IEC24727-6is
currentlyanalcommitteedraftandnalpublicationisanticipatedinmidto
late2009. Internationalsupportofthesespecicationswillassureprescrip-
tiveAPIsandinterfacesforfutureyears
Althoughnotentirelynalized,thisstandardhasbeenpubliclyadoptedby
theEuropeancommunityfortheEuropeanUnionCitizensCard,byGermany
for the German health card, by Australia for their smart card framework,
and by Queensland for the next generation drivers license. We continue
to work with the United States national standards committee to ensure
compatibilitywithfederalcredentialsandtoaddresstheneedsofnonfederal
communities.
Contact:Ms.TeresaSchwarzhoff
(301)975-5727
teresa.schwarzhoff@nist.gov
IDMS Modeling and Metrics
Globally,thereisemphasisonsecurityforidentitymanagement(IDM)thatis
neededtosupportbothlogicalandphysicalaccesscontrol. Manydifferent
solutions are available and under development. For example, the public
sectorhasdeployedseveralidentitymanagementsolutionssuchasPersonal
IdentityVerication (PIV) for federal employees and contractors,Transpor-
tationWorkers Identity Credential (TWIC) for transportation workers, First
ResponderAuthentication Credential (FRAC) for rst responders,passports
for international travelers,and frequent yer programs for registered trav-
elers. Similarly,the private sector has its own identity management solu-
tions to issue and manage identiers deployed for various purposes,such
as employee identication cards, customer loyalty cards, customer credit
cards, amusement park season passes, and username/password combina-
tionsforwebsiteaccess. Alloftheseidentitymanagementsystems(IDMSs)
offersomelevelofsecurity,butitisdifcultfortheownersofeachsystem
toevaluatetheselevelsofsecurityobjectively. Objectiveevaluationwould
alloworganizationstomakeaninformedriskdecisionastowhethertotrust
identitiespresentedfromotherorganizations. Currently,therearenoobjec-
tiveevaluationmetricstodeterminetheleveloftheassuranceinresponse
toquestionssuchasiftheidentityproongprocessofIDMSAisasrigorous
astheproongprocessofIDMSB.
Determining a level or measure of assurance requires the development of
objective,global IDMS metrics that measure the characteristics,protocols,
and processes of an IDMS. The metrics will provide an objective basis for
establishingtrustamongpartiestoanIDMStransaction. Forexample,the
processofidentityproongcouldbeusedasametricthataffectsthelevel
ofassuranceinanidentity.
ThedevelopmentofglobalIDMSmetricsrequiresthecreationofageneric
IDMS model in order to establish a common frame of reference by which
disparate implementations can be compared and contrasted against an
establishedbaselineatmultiplelevelsofanalysis. InFY2008,wedeveloped
thegenericmodelforIDMS,whichwillprovidethebasisforthedevelopment
ofIDMSmetrics. Additionally,wearebeginningtocollaboratewithorgani-
zationsactivelyengagedinthedevelopmentofIDMSstandards,suchasISO
JTC1/SC27andITU-T.Inthefuture,wewillexplorein-depthcharacteristics
ofIDMStodevelopmetricsthatcanbeusedtoobjectivelyevaluateIDMS
implementationsandcaninformdesigndecisionsfornewIDMSimplemen-
tations.
Thesuccessofthisprojectwill:
ProvideamodelandmetricstodeterminealevelormeasureofIDM
assurancefortheinteroperationamongparties.
ProvidedesigndecisionsfornewIDMSimplementations
Assist understanding of identity assurance characteristics of various
IDMSinfrastructuresandenvironments.
Promote trust management for pervasive and community computing
environments by providing a common understanding of risk among
globalentities.
Contacts:
Mr.MatthewBarrett Ms.DonnaDodson
(301)975-3390 (301)975-3669
mbarrett@nist.gov ddodson@nist.gov
Dr.VincentHu Ms.ErikaMcCallister
(301)975-4975 (301)975-5144
vhu@nist.gov erika.mccallister@nist.gov
Mr.MatthewScholl Mr.KevinStine
(301)975-2941 (301)975-4483
matthew.scholl@nist.gov kevin.stine@nist.gov
29
2 0 0 8 A N N U A L R E P O R T
Biometric Standards and Conformity Assessment Activities
Overview
Biometric technologies are used to establish or verify personal identity
against previously enrolled individuals based upon recognition of a physi-
ological or behavioral characteristic.Examples of biological characteristics
includehand,nger,facial,andiris. Behavioralcharacteristicsaretraitsthat
arelearnedoracquired,suchasdynamicsignaturevericationandkeystroke
dynamics.Usingbiometricsforidentifyinghumanbeingsofferssomeunique
advantagesbecauseonlybiometricscanidentifyyouasyou.Usedalone,or
together with other authentication technologies such as tokens,biometric
technologies can provide higher degrees of security than other technolo-
gies employed alone and can also be used to overcome their weaknesses.
Fordecades,biometrictechnologieswereusedprimarilyinlawenforcement
applications,andtheyarestillakeycomponentoftheseimportantapplica-
tions.
Over the past several years, the marketplace for biometrics solutions has
widened signicantly and includes public and private sector applications
worldwide.Biometrictechnologiesareusedindiverseapplicationssuchas
border,aviation,maritime,andtransportationsecurityandphysical/logical
accesscontrol.Marketopportunitiesforbiometricsincludenancialinstitu-
tions,thehealthcareindustry,andeducationalapplications Consumeruses
arealsoexpectedtosignicantlyincreaseforpersonalsecurityandconve-
nienceinhomeautomationandsecuritysystems,andinretail,gamingand
hospitality industries.Biometric technologies are also used in cell phones,
mobilecomputingdevicesandportablememorystorage.
Meeting Government and Other Customers Needs
Manygovernmentandprivatesectorapplicationsrequirebiometric-based,
high-performance,interoperable,informationsystems.Intheabsenceofthe
timelyavailabilityofopensystemsstandards,usersmayneedtouseproprie-
tarysolutions.Migrationfromtheseproprietarysystemstostandards-based
open-systemsolutionsisusuallydifcultandexpensive.
Our program supports the development of open standards for biometrics
and promotes United States innovation and industrial competitiveness
by advancing measurement science, standards and technology. We are
responding to government, industry and market requirements for open-
systemsstandardsby
accelerating development of formal national and international
biometricstandardsandassociatedconformityassessment
educating users on the capability of standards-based open-systems
solutions
promotingstandardsadoption
developingconformancetestingarchitecturesandtestingtoolstotest
implementationsofthesestandards
supportingharmonizationofbiometric,tokensandsecuritystandards
addressing the use of biometric-based solutions for ID Management
applications
In FY2008, we continued to work in close partnership with other United
States Government agencies,United States industry and academic institu-
tions developing formal national and international biometric standards.
WeactivelyparticipateinNSTCsSubcommitteeonBiometricsandIdentity
Management.CSDstaffmembersandotherNIST/ITLexpertsparticipatein
itsStandardsandConformityAssessmentWorkingGroup(SCAWG)andhave
collaboratedwithinthisgroupinthedevelopmentoftheinitialversionofthe
Registry of United States Government Recommended Biometric Standards
whichoutlinesthosestandardsrecommendedforUSGuseinitsoperational
systems.Updates of the Registry are planned.We are also participating in
the Department of Homeland Security BiometricsWorking Group and the
DepartmentofDefenseBiometricsTaskForcesBiometricStandardsWorking
Groupandothergroups..Ourprogramexpertsworkinclosecollaboration
with ITLs Information Access Divisions biometric experts to advance the
adoption of biometric standards. Our program has gained national and
internationalrecognitionforitsachievements.
30
TestCases(XML)
Manifest(XML)
IUT(BinaryBIR)
SBHCTSModules
INCITS398:2008
PatronFormatA ...
Module
BDBCTS
Modules
TestLogs(XML)
TestReports(HTML)
SBCTS
Modules
UserInterface/
Controller
National Biometric Standards Development
Inlate2001,wehelpedtoestablishTechnicalCommitteeM1Biometrics
under the InterNational Committee for Information Technology Standards
(INCITS).BiometricstandardsareconsideredtobecriticalforUnitedStates
needs,suchashomelanddefense,IDmanagement,thepreventionofidentity
theft,and for other government and commercial biometric-based personal
vericationoridenticationapplications.CSDprovidestheChairofINCITS
M1,aswelltheChairforoneoftheveINCITSM1TaskGroups,andactively
participatesinthedevelopmentofitsstandards.During2008NIST/ITL/IAD
provided the staff that served as the chair of one of the other INCITS M1
TaskGroups.
Since its inception, twenty-four biometric standards developed by INCITS
M1havebeenpublishedasAmericanNationalStandards.Theyincludedata
interchangeformatsforanumberofbiometricmodalities,biometrictechnical
interfacestandards,conformancetestingmethodologystandards,biometric
proles,andbiometricperformancetestingandreportingstandards.INCITS
M1 currently has sixteen ongoing standards development projects.During
thelastyear,sevenstandardsdevelopedbyINCITSM1,includingtwostan-
dardsthatwereco-sponsoredbyCSDinINCITSM1:
ANSI INCITS 429-2008, American National Standard for Informa-
tionTechnology - ConformanceTesting Methodology forANSI INCITS
358-2002,BioAPISpecication,May2008
ANSI INCITS 398-2008, American National Standard for Informa-
tion Technology Common Biometric Exchange Formats Framework
(CBEFF),January2008
International Biometric Standards Development
In2002,wesuccessfullysupportedtheestablishmentofSubcommittee37
- BiometricsundertheISO/IECJointTechnicalCommittee1(ISO/IECJTC1).
CSD provides the Chair of SC37, NIST/ITL provides a member of the staff
to serve as the Chair of one of its six Working Groups, and NIST/ITL/IAD
providestechnicaleditorssupportingthedevelopmentofsomeoftheJTC1/
SC37projects.JTC1/SC37hascompletedtherstgenerationofbiometric
datainterchangeformatandinterfacestandards.
Todatetwenty-fourstandardsdevelopedbythisSubcommitteehavebeen
publishedasInternationalstandards.Theyincludedatainterchangeformats
for a number of biometric modalities, biometric technical interface stan-
dards,biometricperformancetestingandreportingstandardsandbiometrics
proles.Threetechnicalreportshavebeenpublishedaswell.
JTC1/SC37songoingprogramofworkofftystandardprojectsincludesa
biometricvocabulary,interface-relatedstandards,datainterchangeformats,
andtestingandperformancespecications.
Conformity Assessment to Biometric Standards
Basestandards,suchasbiometricdatainterchangeandtechnicalinterface
standards,donotcontaintheconditionstodemonstratethatproductsmeet
thetechnicalrequirementsspeciedinthestandards.Conformancetesting
capturesthetechnicaldescriptionofaspecicationandmeasureswhether
an implementation faithfully implements the specication.A conformance
testsuiteimplementationistestsoftwarethatisusedtoascertainconfor-
mance to a testing methodology described in a specication or standard.
Wesupportthedevelopmentofbiometricconformancetestingmethodology
standardsandotherconformityassessmenteffortsthroughactivetechnical
participationinthedevelopmentofthesestandards,sponsorshipofspecic
biometric conformance testing methodology standards (e.g., conformance
testingmethodologiesforbiometrictechnicalinterfacesandbiometricdata
interchange formats), and the development of associated conformance
testingarchitectures.WedevelopthesearchitecturesandConformanceTest
Suites(CTSs)tosupportusersthatrequireconformancetoselectedbiometric
standards and to support product developers interested in conforming to
biometricstandardsbyusingthesametestingtoolsavailabletousers.These
31

2 0 0 8 A N N U A L R E P O R T
testing tools support the possible establishment of conformity assessment
programstovalidateconformancetobiometricstandards.
BioAPI Conformance Test Suite
In2006wereleasedaBioAPICTSdevelopedtotestimplementationsofANSI
INCITS358-2002,theBioAPIspecication.Thissoftwaretoolwasdeveloped
tohelpusersverifytheconformanceofBiometricServiceProviderstoANSI
INCITS 358-2002, the BioAPI Specication 1.1.The BioAPI CTS and asso-
ciated documentation can be found at NISTs Biometric Resource Center
website(http://www.nist.gov/biometrics)Wealsoco-sponsoredwithother
members of INCITS M1 a conformance testing methodology standard for
BioAPI.TheBioAPICTSimplementationwasdevelopedusingconceptsand
principlesspeciedinthisconformancetestingmethodologystandard.The
CTSwasthoroughlytestedwithanumberofcommerciallyavailablevendor
biometricsubsystemsfordifferentmodalities(e.g.,face,irisandngerprint
recognition)claimingconformancetotheBioAPIstandard.Thetestresults
were successfully cross-validated with another similar CTS independently
developedbyDoDsBiometricTaskForce.
Conformance Testing Architectures for Biometric Data Inter-
change Formats and CBEFF Biometric Information Records
InAugust2008wereleasedaconformancetestingarchitecturethatsupports
CTSs to test implementations of biometric data interchange formats and
the three components of CBEFF Biometric Information Records (metadata,
biometric data and security blocks).We also released a CTS to test imple-
mentations of Patron Format A data structures specied in ANSI INCITS
398-2008,Information technology - Common Biometric Exchange Formats
Framework.The software and documentation can also be found at NISTs
BiometricResourceCenter.TheCTSforPatronFormatAsupportedbythis
conformance testing architecture was developed to help users determine
whetherbinaryleimplementationsofBiometricInformationRecords(BIRs)
basedonthisPatronFormatconformornottothestandard.NIST/ITLCSD
sponsoredinINCITSM1developmentofaconformancetestingmethodology
standardforCBEFFdatastructuresspeciedinANSIINCITS398-2008and
hassubmittedtoINCITSM1thetestassertionsandrelatedtestcasesdevel-
opedforthePatronFormatAConformanceTestSuiteaswellastestasser-
tions and test cases for other Patron Formats specied in theANSI INCITS
398-2008standard.Thisstandardisunderdevelopment.
Ongoing work
An advanced conformance testing architecture is currently being devel-
oped.Someofthekeyimprovementsbeingresearchedand/orimplemented
include:
Module Dynamic Discovery Similar to well-known programs that
support add-ins or plug-ins, this implementation loads CTS
modulesatruntime. Therearetwomainbenetsofthisarchitecture:
themodulescanbedevelopedwithoutmodifyingtheGUIsourcecode,
andneworupdatedmodulesareeasilydistributedandinstalled.
WebServicesModulescanbecalledeitheronthelocalcomputeror
onawebservicescomputeranywhereontheinternetoranintranet.
TestCaseEnhancementTestCasesaregreatlyimproved,allowingfar
fewerTestCasestotestmoresuccessandfailureconditions.
Testing Flexibility Any module can be tested by itself (e.g.,confor-
mancetestingtoastandardbiometricdatainterchangeformat).
Impact of Biometric Standards and Related Conformity
Assessment
Some of the rst generation of biometric standards are now required
by customers of personal authentication applications. Large organizations
such as the International CivilAviation Organization (ICAO) (for Machine
ReadableTravel Documents),the International Labour Ofce of the United
Nations (for the Seafarers Identication Credential program) as well as
the European Union (EU) have published requirements that include the
useofinternationalbiometricstandardsdevelopedbyJTC1/SC37.TheEU
passwordspecicationworkingdocument,forexample,describessolutions
for chip-enabled EU passports,based on EUs Council Regulation on stan-
dardsforsecurityfeaturesandbiometricsinpassportsandtraveldocuments
issuedbymemberstates.Thespecicationreliesoninternationalstandards,
especiallyISOstandardsandICAOrecommendationsonMachineReadable
TravelDocuments,andincludesspecicationsforbiometricfaceandnger-
print identiers;thus,the specications are underpinned by ISO standards
resultingfromtheworkofJTC1/SC37.SeveralcountriesrepresentedinJTC
1/SC37arealsoadoptingtheJTC1/SC37standards.Forexample,inSpain
twoofcialdocumentsstorebiometricdatausingJTC1/SC37standards. The
electronicnationalidentitycard(DNIe)includespersonalinformationofthe
citizen,details of electronic certicates and the biometric information.The
imageofthefaceisstoredfollowingtheJTC1/SC37faceimageformatand
ICAOstandards.FingerminutiaearestoredusingtheJTC1/SC37standard.
ThebiometricdataincludedinSpanishe-Passportsistheimageoftheface
basedontheJTC1/SC37standardaswellastheICAOstandardforMRTDs.
In the United States,several organizations require selected biometric data
interchangestandardsdevelopedbyJTC1/SC37.Examplesincludeapplica-
tionsandtestsperformedbygovernmentorganizations,privateindustry,and
consortia.TheTransportation SecurityAdministration (TSA) of the Depart-
mentofHomelandSecurity(DHS)hasissuedguidanceforuseofbiometric
32
technologyinairportaccesscontrolsystemsandisperformingteststoestab-
lishaqualiedproductslistofbiometrictechnologiesthatmeetstandards
setforthintheaforementionedguidance.ProductstestedinTSAQualied
ProductList(QPL)Testingincludeenrollmentstationsandbiometricsensors/
readers that can be deployed at access points to secure airport areas.The
testrequirementsreferencetwopartsofthemulti-partstandarddeveloped
byJTC1/SC37onbiometricperformancetestingandreporting.NISTuseda
partofthismulti-partstandardfortheMinutiaeInteroperabilityExchange
Test (MINEX) tests. The Registered Traveler Interoperability Consortium
(RTIC)usessomeoftheJTC1/SC37standardsaswell.
INCITS M1 biometric standards are also required in major United States
Government programs. Transportation Worker Identication Credential
(TWIC)-PhaseIII-PrototypePhase-(DHS/TSA)requiredINCITSbiometric
standards such as the application prole - Interoperability and Data Inter-
change - Biometric BasedVerication and Identication ofTransportation
Workers.DoDITStandardsRegistryincludesanumberofthebiometricdata
interchangeformatstandardsdevelopedbyINCITSM1. ThePersonalIdentity
Verication (PIV) specication (NIST SP 800-76-1) includes conformance
requirements to several data interchange format standards including the
ngerminutiaetemplate,thengerimageandthefaceimagedataformat
standards as well as an instantiation of a BIR conforming to the CBEFF
standardpublishedin2005(INCITS398-2005).TheRegisteredTravelerTech-
nicalInteroperabilityspecicationrequiresconformancetoamodiedCBEFF
BIRspeciedbythePIVspecicationaswellasthengerandfaceimage
data interchange formats developed by INCITS M1.The Registry of USG
Recommended Biometric Standards recommends a number of biometric
standardsdevelopedbyINCITSM1andJTC1/SC37.AWorkingGroupestab-
lishedbytheCustomerServiceDepartmentoftheReserveBankofIndiato
suggestsuitablestandardsforrawimagesofngerprintsrecommendedthe
ngerimagestandarddevelopedbyJTC1/SC37.
WeexpectthattheadoptionofstandardsdevelopedbyINCITSM1andJTC1/
SC37willsignicantlyincreaseinthenearfuture.Therearestillanumber
ofnationalandinternationalstandardsunderdevelopmentthatshouldreap
bigpayoffs.CSDstaffisinstrumentalinpromotingongoingbiometricsstan-
dardsworkandtheadoptionofthesestandards.Theworkonnationaland
internationalbiometricstandardsandourrelatedtechnicalworkhavebeen
presentedbyCSDstaffatnationalandinternationalconferencesandpubli-
cations.
The Biometric Consortium
The Biometric Consortium (BC) serves as a focal point for research,devel-
opment, testing, evaluation, and application of biometric-based personal
identication/vericationtechnology. TheBCmaintainsaweb-basedBulletin
Board (BCBB).
1
The BC promoted government and industry specications
under the umbrella of NIST/BC Biometric Interoperability, Performance
and Assurance Working Group. This Working Group developed the rst
specicationofCBEFFpublishedasNISTIR6529andthebiometrictemplate
protectionspecication,nowastandardprojectunderdevelopmentinISO/
IECJTC1/SC27.Today,theBCsprimaryfunctionistoorganizeandhostan
annualconference,whichenablesU.S.governmentparticipantsto.engagein
exchangeswithnationalandinternationalparticipants. CSDstaffco-chairs
theConsortiumandhelpstoplanitsconferenceswiththeNSAco-chair.
The 2008 conference,held September 23-25 addressed the important role
thatbiometricscanplayintheidenticationandvericationofindividualsin
government and commercial applications worldwide.Topics included tech-
nologyinnovations,biometricstandardsandthelatesttrendsinbiometrics
research, development and applications of biometric technologies as well
ascurrentgovernmentinitiativesandcommercialapplicationsintheUnited
Statesandabroad.TheBiometricsSymposium,aspecialsessiononresearch
washeldasoneoftheconferencesessions.TheSymposiumwassponsored
by the Biometric Knowledge Center of the National Science Foundation
Center for Identication Technology Research (CITeR) and co-sponsored
byIEEE,theIEEEComputerSocietyandIEEEPatternAnalysisandMachine
IntelligenceTechnicalCommittee.
One of the largest conferences dedicated to biometrics worldwide, the
conferenceaswellastheco-locatedTechnologyExpoattractedmorethan
1,500participantsfromUnitedStatesandforeigngovernments,commercial
organizations,industry,andacademia.Over120internationallyrecognized
experts in biometric technology, system application and standards devel-
opers,ITstrategists,governmentandcommercialexecutivesanduniversity
researchers participated in the program.The conference was co-sponsored
by NIST/ITL, National Security Agency (NSA), Department of Homeland
Security(DHS),DoDBiometricsTaskForce,NationalInstituteofJustice(NIJ),
GeneralServicesAdministration-OfceofTechnologyStrategy(GSA),Volpe
NationalTransportationSystemsCenter,UnitedStatesDepartmentofTrans-
portationandtheArmedForcesCommunicationsandElectronicsAssociation
(AFCEA).FiveKeynotespeakersfromgovernmentandindustryparticipated
intheprogram.Inadditiontothethreeconcurrentconferencetracks,aseries
ofspecialsessionsandworkshopswereheld.
NIST/ITLs biometric programs were represented at the NIST/ITL Booth,
including ongoing activities of the Information Systems and the Computer
SecurityDivisions.Thebiometricconformancetestingarchitecturereleased
inAugust2008andanexistingCTSmodule,aswellasapre-releasedversion
of the advance architecture that supports CTSs for biometric data inter-
1
http://www.nist.gov/bc2008
33
2 0 0 8 A N N U A L R E P O R T
changeformatsandCBEFFBiometricInformationRecords,bothdeveloped
byCSDstaff,weredemonstratedatthisbooth.
http://www.nist.gov/biometrics
Contact:Mr.FernandoPodio
(301)975-2947
fernando.podio@nist.gov
Research in Emerging Technologies
Automated Combinatorial Testing for Software
NISTresearchsuggeststhatsoftwarefaultsaretriggeredbyonlyafewinter-
actingvariables.Theseresultshaveimportantimplicationsfortesting.Ifall
faultsinasystemcanbetriggeredbyacombinationofnorfewerparameters
(wherenisthenumberofparameters),thentestingalln-waycombinations
ofparameterscanprovidehighcondencethatnearlyallfaultshavebeen
discovered.Forexample,ifweknowfromhistoricalfailuredatathatfailures
foraparticularapplicationneverinvolvedmorethanfourparameters,then
testing all 4-way or 5-way combinations of parameters gives strong con-
dencethatawswillbefoundintesting.
We are working with the University of Texas,Arlington on a project that
was initiated in 2006 to take advantage of this empirical observation by
developingsoftwaretestmethodsandtoolsthatcantestalln-waycombina-
tionsofparametervalues.Themethodshavebeendemonstratedinaproof-
of-concept study that was presented at a NASA conference and are being
further developed through application to real-world projects at NIST and
elsewhere.
This work uses two relatively recent advances in software engineering
algorithmsforefcientlygeneratingcoveringarraysandautomatedgenera-
tionoftestoraclesusingmodelchecking.Coveringarraysaretestdatasets
thatcoveralln-waycombinationsofparametervalues. Pairwise(allpairsof
values)testinghasbeenpopularforsometime,butourresearchindicates
that pairwise testing is not sufcient for high assurance software. Model
checkingtechnologyenablestheconstructionoftheresultsexpectedfroma
testcasebyexploringallstatesofamathematicalmodelofthesystembeing
tested.Toolsdevelopedinthisprojectwillhaveapplicationsinhighassur-
ancesoftware,safetyandsecurity,andcombinatorialtesting.
Ourfocusisonempiricalresultsandreal-worldproblems.Accomplishments
forFY2008includethefollowing:
Theprojectteamreleasedsoftwareimplementinganewcoveringarray
algorithmthatoutperformsotherknownalgorithms,insomecasesby
severalordersofmagnitude. Thenewtoolhasbeenacquiredbyover
100 beta users, including most of the major software and hardware
developersandanumberofuniversities. Severalusershaveexpressed
interest in cooperating on joint projects to analyze the effectiveness
of combinatorial testing on their real-world projects. In FY2008 the
software was improved based on feedback from beta users. Several
newsarticlesonthesoftwaretoolsandtheprojectappearedinITtrade
publications.
Research in FY2008 included a large study comparing combinatorial
and random testing for a grid computer network simulation, a joint
projectinitiatedwithNorthCarolinaStateUniversityoncombinatorial
testing for analyzing access control systems,and improvements on a
parallel covering array algorithm developed previously. Joint work
withNIST/MEL(ManufacturingEngineeringLaboratory)andChalmers
University (Sweden) was also initiated on applying these methods to
manufacturingsimulation.
A repository for covering arrays,the rst of its kind,was established
in FY2007 on the NIST Mathematical and Computational Sciences
Divisionserver.Therepositoryhasnowbeenpopulatedwithalargeset
ofcoveringarraysforusebyresearchersinavarietyofelds,including
biotechnology,statistics,andsoftwaretesting.
Plans for FY2009 include measuring the effectiveness of combinatorial
testingforXMLvalidationandWebapplicationtesting,accesscontrolpolicy
and rewall testing, and working with industry researchers and practitio-
nerstotransitionthetoolsandmethodsintopracticalapplication. Weare
working with researchers from several major universities, other NIST divi-
sionsandlabs,andprivateindustry.
http://csrc.nist.gov/acts
Contacts:Mr.RickKuhn Dr.RaghuKacker
(301)975-3337 MathematicalandComputationalSciencesDivision
kuhn@nist.gov (301)975-2109
raghu.kacker@nist.gov
Conformance Verication for Access Control Policies
Accesscontrol(AC)systemsareamongthemostcriticalofnetworksecurity
components.Faulty policies,miscongurations,or aws in software imple-
mentation can result in serious vulnerabilities.The specication of access
controlpoliciesisoftenachallengingproblem.Itiscommonthatasystems
privacyandsecurityarecompromisedduetothemiscongurationofaccess
34

controlpoliciesinsteadofthefailureofcryptographicprimitivesorprotocols.
Thisproblembecomesincreasinglysevereassoftwaresystemsbecomemore
andmorecomplex,andaredeployedtomanagealargeamountofsensitive
informationandresourcesthatareorganizedintosophisticatedstructures.
Identifyingdiscrepanciesbetweenpolicyspecicationsandtheirproperties
(intendedfunction)arecrucialbecausecorrectimplementationandenforce-
mentofpoliciesbyapplicationsisbasedonthepremisethatthepolicyspeci-
cationsarecorrect.Asaresult,policyspecicationsmustundergorigorous
verication and validation through systematic testing to ensure that the
policyspecicationstrulyencapsulatethedesiresofthepolicyauthors.
Toformallyandpreciselycapturethesecuritypropertiesthataccesscontrol
shouldadhereto, ACmodelsareusuallywritten, bridgingtheratherwidegap
inabstractionbetweenpolicyandmechanism:usersseeanaccesscontrol
modelasanunambiguousandpreciseexpressionofrequirements;vendors
andsystemdevelopersseeaccesscontrolmodelsasdesignandimplemen-
tationrequirements.Thus,techniquesarerequiredforverifyingwhetheran
ACmodeliscorrectlyexpressedintheACpoliciesandwhethertheproper-
tiesaresatisedinthemodel.Inpractice,thesameaccesscontrolpolicies
may express multiple access control models or express a single model in
additiontoextraaccesscontrolconstraintsoutsideofthemodel.Ensuring
theconformanceofaccesscontrolmodelsandpoliciesisanon-trivialand
criticaltask.
Duringthepastyear,wedevelopedageneralapproachofpropertyverica-
tionforaccesscontrolmodelsbycombiningmodelcheckingandcombinato-
rialtesting.Todemonstratetheproofofconcept,wealsodevisedprototype
AC models for the application of various testing tools such as NuSMV
modelcheckerandFireeyescombinatorialarraygenerator.Ourreportswere
publishedatsomemajorrelatedsymposiumsandconferences.Inthecoming
year,wewillextendourprototypesystemtoapracticalsystemthatcanbe
appliedtogenericACmodels.Wewillalsoinvestigatein-depthissuessuch
ascodeassertionverication,limitation,andnone-modelapplications.
Thisprojectisexpectedto:
Provide generic paradigm and framework of access control model/
propertyconformancetesting;
Providetoolsorservicesforcheckingthesecurityandsafetyofaccess
controlimplementation;
Promote(oraccelerate)theadoptionofcombinatorialtestingforlarge
systemtesting;and
Assistsystemarchitects,securityadministrators,andsecuritymanagers
whoseexpertiseisrelatedtoaccesscontrolinmanagingtheirsystems,
andtolearnthelimitationsandpracticalapproachesfortheirapplica-
tions.
Contacts:Dr.VincentHu Mr.RickKuhn
(301)975-4975 (301)975-3337
vhu@nist.gov kuhn@nist.gov
Forensics for Web Services
WebservicesarebecomingapopularwaytodesignandimplementaService
Oriented Architecture (SOA) in areas such as nancial, government and
militaryapplications.Webservicesenableaseamlessintegrationofdifferent
systemsovertheInternetusingchoreographies,orchestrationsanddynamic
invocations.WebservicesbasedontheeXtensibleMarkupLanguage(XML),
Simple Object Access Protocol (SOAP), and related open standards, and
deployed in SOA allow data and applications to interact without human
interventionthroughdynamicandadhocconnections.
ThesecuritychallengespresentedbytheWebservicesapproachareformi-
dable. Many of the features that make Web services attractive, including
greater accessibility of data, dynamic application-to-application connec-
tions,andrelativeautonomy(lackofhumanintervention)areatoddswith
traditional security models and controls. The complexity in web services
arises due to composing new services.These compositions create service
inter-dependenciesthatcanbemisusedformonetaryorothergains.Whena
misuseisreported,investigatorshavetonavigatethroughacollectionoflogs
torecreatetheattack.Inordertofacilitatethattask,weareinvestigating
techniques for forensics on web services (FWS),a specialized web service
that when used would securely maintain transactional records between
otherwebservices.Thesesecurerecordscanbere-linkedtoreproducethe
transactionalhistorybyanindependentagency. InFY2008aspartofthis
project,weshowedthenecessarycomponentsofaforensicframeworkfor
webservicesandpublishedapaperinaconference.InFY2009weplanto
doaproofofconceptimplementationtovalidateourresultsandpublishthe
resultsasaNISTInternalReport.
Contact:Dr.AnoopSinghal
(301)975-4432
Anoop.singhal@nist.gov
Mobile Handheld Device Security and Forensics
Cell phones and other mobile handheld devices are ubiquitous today,
used by individuals for both personal and professional purposes. Mobile
devicescanallowuserstoplacecalls,performtext,multimedia,andinstant
35

2 0 0 8 A N N U A L R E P O R T
messaging, exchange electronic mail, browse the Web, manage personal
information (e.g., address book, task list, and calendar schedule), capture
photosandvideos,andalsoread,edit,andcreatedigitaldocuments. Over
time,asignicantamountofinformationtendstoaccumulateonthemthat
mayneedtobeprotectedfromintrudersortoberecoveredasevidencefora
securityincidentorcrimeinvestigation. Becauseoftheirpervasivenessand
capabilities,mobilehandhelddevicesareanemergingbutrapidlygrowing
areaofcomputersecurityandforensics.
Although mobile handheld devices are approaching the functionally of
desktop computers,their organization and operation are quite different in
certainareas. Forexample,mostcellphonesdonotcontainaharddriveand
rely instead on ash memory for persistent storage. They also are gener-
allytreatedmoreasxedapplianceswithalimitedsetoffunctionsthanas
general-purpose systems with the capability for expansion, and no single
operatingsystemdominatescellphones. Suchdifferencesmaketheapplica-
tionofclassicalcomputersecurityandforensictechniquesdifcult.
The focus of the project is twofold: to improve the security of handheld
devicesdevelopandtoimprovethestate-of-the-artofmobiledeviceforen-
sics. Pastworkinhandhelddevicesecurityincludedseveralproof-of-concept
implementations of security mechanisms suitable for the capabilities and
limitationsofsuchdevices. TheyaredocumentedontheprojectWebsite.
This past year, we produced Special Publication (SP) 800-124, Guidelines
onHandheldDeviceSecurity. Thepublicationprovidesanoverviewofcell
phoneandPersonalDigitalAssistant(PDA)devicesinusetodayandoffers
insightsintomakinginformedinformationtechnologysecuritydecisionson
theirtreatment. Thecontentcoversdetailsaboutthethreatsandtechnology
risksassociatedwiththeuseofthesedevicesandtheavailablesafeguards
tomitigatethem. Usersofcellphones,PDAs,andotherbusiness-oriented
handhelddevices,aswellassecurityprofessionalsandofcialsintheorga-
nizationwhoareresponsibleforinformationtechnologysecuritythroughout
thesystemlifecycle,shouldndtheinformationbenecial.
PriorworkatNISTinthemobiledeviceforensicsareaexaminedthequality
and use of forensic tools. During FY2008, our work has progressed to
identifying and removing impediments to the practice of cell phone foren-
sics. The rst development is a forensically sound method to address the
problems forensic tools have with latency in coverage for newly avail-
able phone models coming onto the market. The approach,called phone
managerprotocolltering,augmentsthefunctionalityofoff-the-shelfphone
managers,availablefromdevicemanufacturers,toblockunsafecommands.
NIST recently issued Interagency Report (NISTIR) 7516, Forensic Filtering
ofCellPhoneProtocols,whichdocumentsthetechniqueasappliedtotwo
popularphonemanagers.
The second development in mobile device forensics in FY2008 is a means
to validate the correct functioning of forensic tools quickly and accurately.
Theapproach,calledidentitymoduleprogramming,automaticallypopulates
the identity modules of certain classes of cell phones with reference test
datathatserveasabaselineforvalidatingthecorrectfunctioningofrelated
forensictools. Aconferencepaperonthetechnique,ReferenceMaterialfor
Assessing Forensic SIMTools, has been published and is available on the
projectWebsite. Amorein-depthNISTIRisexpectedtofollowsoon. The
intendedaudienceforpublicationsinmobiledeviceforensicsrangesbroadly
from response team members handling a computer security incident, to
organizationalsecurityofcialsinvestigatinganemployee-relatedsituation,
toforensicexaminersinvolvedincriminalinvestigations.
http://csrc.nist.gov/groups/SNS/mobile_security/
Contact:Mr.WayneJansen
(301)975-5148
wjansen@nist.gov
36
Policy Machine
Asamajorcomponentofanyoperatingsystemorapplication,accesscontrol
mechanismscomeinawidevarietyofforms,eachwiththeirindividualattri-
butes,functions,methods for conguring policy,and a tight coupling to a
classofpolicies.Anaturalconsequenceofthedeploymentofmanyhetero-
geneoussystemsisalackofinteroperability.Alackofinteroperabilitymay
not be a problem for systems that can adequately operate independently
of one another, but access control mechanisms require interoperability to
function efciently. Users with vastly different credentials have a need to
accessresourcesprotectedunderdifferentmechanisms,andresourcesthat
are protected under different mechanisms differ vastly in their sensitivity
andthereforeaccessibility.Thislackofinteroperabilityintroducessignicant
privilegeandidentitymanagementissues.
Interoperationisoneproblemassociatedwithtodaysaccesscontrolopera-
tions.Anotherproblempertainstopolicyenforcement.Sincetheearlydays
of shared computing, research programs have focused on creating access
control models that support specic organization and resource sensitivity
requirements.Of the numerous recognized access control policies,todays
operatingsystems(Oss)arelimitedtotheenforcementofinstancesofDiscre-
tionary Access Control (DAC) and simple variations of Role-Based Access
Control (RBAC) policies, and to a far lesser extent, instances of Manda-
toryAccess Control (MAC) policies.As a consequence,there are a number
of important policies (orphan policies) that lack a commercially viable OS
mechanismfortheirenforcement.Amongtheseorphanpoliciesistheneed
tocombinearbitrarypolicies.
Tollpolicyvoids,policiesareroutinelyaccommodatedthroughtheimple-
mentationofaccesscontrolmechanismsattheapplicationlevel.Essentially,
anyapplicationthatrequiresausersauthenticationimplementssomeform
ofaccesscontrol.Notonlydoapplicationsaggravateinteroperation,identity
and privilege management problems, but applications can also under-
mine policy enforcement objectives.For instance,although a le manage-
mentsystemmaynarrowlyrestrictaccesstoaspecicle,chancesarethe
contentsofthatlecanbeattachedtoorcopiedtoamessageandmailed
toanyoneintheorganizationortheworld.
To solve the interoperability and policy enforcement problems of todays
accesscontrolparadigm,NIST(inpartundersponsorshipoftheDepartment
ofHomelandSecurity)hasdesignedanddevelopedareferenceimplemen-
tation for a standard access control mechanism referred to as the Policy
Machine (PM). The PM is not an extension of any existing access control
model or mechanism,but instead is an attempt to fundamentally redene
accesscontrolingeneralfromitsbasicabstractionsandprinciples.Indoing
so,we believe that the PM as currently specied and implemented repre-
sentsaparadigmshiftnotonlyinthewaywecanspecifyandenforcepolicy,
butalsointhewaywecandevelopapplications,interactwith,andapproach
our computer systems.The PM requires changes only in its conguration
in the enforcement of arbitrary and organization-specic, attribute-based
access control policies. Included among the PMs enforceable policies are
combinations of policy instances (e.g., Role-Based Access Control and
Multi-Level Security).In its protection of objects under one or more policy
instances,thePMcategorizesusersandresourcesandtheirattributesinto
policyclassesandtransparentlyenforcesthesepoliciesthroughaseriesof
xedPMfunctionsthatareinvokedinresponsetouserorsubject(process)
accessrequests.
InFY2008,wedevelopedasimplerPMspecicationandrevisedourrefer-
ence implementation to reect those changes. Although simpler, the PM
preservesitsexpressivecapabilities(intermsofpoliciesthatcouldbecong-
uredandenforced).Thisincludessupportfordatabaserecordsascomposite
PMobjects.Throughcompositeobjects,weareabletoprovideprotectionat
thegranularityofaeldwithinarecordoraform.Inadditionwemanaged
to congure new policies used to conne and track the dissemination of
sensitivedata.Thisincludestheprotectionofcopiesandextractsofsensitive
dataunderthesamepoliciesastheoriginal.Inadditionwearecurrentlyin
theprocessofdevelopingnewarchitecturalandfunctionalspecicationsfor
thePM,which,webelieve,willfurtherenhanceitsefciencyandscalability.
Ifsuccessful,webelievethatthePMcanbenetorganizationsinanumber
ofways,including
Policy exibility Virtually any collection of attribute-based access
controlpoliciescanbeconguredandenforced.
PolicycombinationsResources(objects)couldbeselectivelyprotected
underanycombinationofcurrentlyconguredpolicies(e.g.,DAConly,
orDACandRBAC).
SinglescopeofcontrolPoliciesimplementedatthelemanagement
and application levels today can be congured and enforced and as
such are included in the PMs scope of control.Demonstrated appli-
cation services include internal email, workow management, and
databasemanagement.
Enterprise wide scope of protection One administrative domain
vs. administration on an OS-by-OS basis, access control policies are
uniformly enforced over resources that are physically stored under
differentoperatingsystems.
Comprehensive enforcement All user and process access requests,
andallexchangeofdatatoandfromandamongapplications,between
processes and access sessions, all exportation of data outside the
37

2 0 0 8 A N N U A L R E P O R T
boundsofthePMareuniformlycontrolledundertheprotectionpolicies
oftheobjectsofconcern.
Assurance Conguration strategies could render malicious applica-
tioncodeharmless,allenforcementcouldbeimplementedatthekernel
level,andattributescouldbeautomaticallyandminimallyassignedto
sessions(leastprivilege)totausersaccessrequests(asopposedto
ausersattributeselection).
Truesingle-signonByvirtueofthePMssinglescopeofcontroland
apersonalobjectsystem(POS)thatincludesthepotentialtoviewand
openalluseraccessibleresources,theneedforausertoauthenticate
tomultipleapplicationsandsystemsiseffectivelyeliminated.
Contacts:Mr.DavidFerraiolo Dr.VincentHu
(301)975-3046 (301)975-4975
david.ferraiolo@nist.gov vhu@nist.gov
Security for Grid and Pervasive Systems
Whilegridandpervasivecomputinghavebecomeclosertorealityduetothe
maturityofthecurrentcomputingtechnologies,thesetechnologiespresent
greater challenges compared to static network systems with infrastructure
security issues such as authorization, directory services, and rewalls.The
researchavailableongridandpervasivesecurity-relatedtopicsistargetedto
onespecicsystem,isincompletebymakingassumptions,orisambiguous
regardingthecriticalelementsintheirworks.Becauseofthecomplexitiesof
architectureandapplicationsofthegrid,apracticalandconceptualguidance
fortheirsecurityisneeded.
DuringFY2008,we1)identiedaccesscontrolrequirementsandissuesthat
arespecictogridandpervasivecomputing,2)developedatrustmanage-
ment protocol for multi-grid environments, and 3) investigated solutions
for composing access control policies for resource federation networks
using emerging pervasive computing technologies such as Semantic Web
and Resource Description Framework (RDF). Our ndings were presented
at some major related symposiums and conferences. In FY2009, we will
extendourinvestigationfromgridcomputingonlytoincludetrustmanage-
ment frameworks, functional stacks, protocols, andAPIs for the pervasive
systems security functions that have either been embedded or recom-
mended by commercial or standards organizations. In the future, we will
focusonanalyzingthecapabilitiesandlimitationsofauthorizationmanage-
mentinfrastructuresthattheselectedgridorpervasivesystemsofprevious
researcharecapableofproviding. Wewillalsodevelopguidedocumenta-
tionsorreferenceimplementationsusingalready-developedtools(suchas
Globus andAccess Control languages) to demonstrate how to congure a
gridorpervasivesystemtosatisfythesecurityrequirements.
Weexpectthatthisprojectwill:
Promote (or accelerate) the adoption of community computing that
utilizesthepowerofsharedresourcesandcomputingtimeofgridand
pervasiveinfrastructure;
Provide prototype security standards for the authorization manage-
mentofcommunitycomputingenvironments;
Increase security and safety of static (connected) distributed systems
byapplyingthetrustdomainconceptofgridandpervasivecomputing;
and
Assistsystemarchitects,securityadministrators,andsecuritymanagers
whoseexpertiseisrelatedtocommunitycomputinginmanagingtheir
systems,andtolearnthelimitationsandpracticalapproachesfortheir
applications.
Contact:Dr.VincentHu
(301)975-4975
vhu@nist.gov
Technical Security Metrics
Measurementisthekeytomakingmajoradvancementsinanyscienticeld,
and computer security is no exception. Measures give us a standardized
way of expressing security characteristics. Because of the ever-increasing
complexity of threats, vulnerabilities, and mitigation strategies, there is a
particularly strong need for additional research on attack, vulnerability,
38

and security control measurement. Improved measurement capabilities in
theseareaswouldalloworganizationstomakescienticallysounddecisions
whenplanning,implementing,andconguringsecuritycontrols. Thiswould
improvetheeffectivenessofsecuritycontrols,whilereducingcostbyelimi-
natingunnecessary,ineffectivecontrols.
In FY2008, CSD began a long-term project on technical security metrics,
focusedprimarilyonattack,vulnerability,andsecuritycontrolmeasurement.
Apaperdetailingthetechnicalconceptsbehindtheprojectwaspresentedat
the1stInternationalIEEEConferenceonInformationTechnologyinGdansk,
PolandinMay2008. Therststageofthisworkinvolvesdevelopingspeci-
cationsformeasuringandscoringindividualvulnerabilities,andresearching
howvulnerabilitiesfrommultiplehostscanbeusedinsequencetocompro-
mise particular targets. A summary of these efforts from the past year is
presentedbelow.
Vulnerability Measurement and Scoring
The Common Vulnerability Scoring System (CVSS) is an industry standard
that enables the security community to calculate the relative severity of
softwareawvulnerabilitieswithininformationtechnologysystemsthrough
setsofsecuritymetricsandformulas.TheCVSSversion2standardisbeing
promoted by a special interest group within the international Forum of
Incident Response and SecurityTeams (FIRST). During the past year, NIST
securitystaffprovidedtechnicalleadershipindetermininghowCVSScould
beadaptedforusewithothertypesofvulnerabilitiesbesidessoftwareaws.
Thisworkresultedinthedevelopmentofthefollowingpublications:
DraftNISTInteragencyReport(NISTIR)7502,TheCommonCongura-
tionScoringSystem(CCSS),publishedinMay2008. CCSSisbasedon
CVSS but has been customized for use with software conguration-
relatedvulnerabilities.
Paper on the research efforts behind CCSSs development,presented
at the 4
th
Workshop on Quality of Protection (QoP 2008) in October
2008.
Draft NISTIR on the Common Misuse Scoring System (CMSS), to be
publishedinFY2009. CMSSadaptsCVSSforusewithfeaturemisuse
andtrustrelationshipmisusevulnerabilities.
NIST has also been analyzing CVSS version 2 scores calculated for the
NationalVulnerabilityDatabase(NVD)toidentifypossibleshortcomingsof
CVSS version 2 and the existing scoring documentation. During FY2009,
weplantorecommendchangesandadditionstotheCVSSversion2speci-
cation to clarify how scoring should be performed so as to improve the
consistencyofCVSSscoresacrossorganizations. Wealsoplanonnalizing
theCCSSspecicationandpublishingadraftoftheCMSSspecicationnext
year.
http://nvd.nist.gov/cvss.cfm?version=2
Contacts:Ms.KarenScarfone Mr.PeterMell
(301)975-8136 (301)975-5572
karen.scarfone@nist.gov mell@nist.gov
Network Security Analysis Using Attack Graphs
Atpresent,computernetworksconstitutethecorecomponentofinformation
technologyinfrastructuresinareassuchaspowergrids,nancialdatasystems
and emergency communication systems. Protection of these networks from
maliciousintrusionsiscriticaltotheeconomyandsecurityofournation.To
improvethesecurityofthesenetworksystems,itisnecessarytomeasurethe
amount of security provided by different network congurations.The objec-
tive of our research is to develop a standard model for measuring security
ofcomputernetworks. Astandardmodelwillenableustoanswerquestions
suchasarewemoresecurethanyesterdayorhowdoesthesecurityofone
networkcongurationcomparewithanotherone. Also,havingastandard
model to measure network security will bring together users, vendors and
researcherstoevaluatemethodologiesandproductsfornetworksecurity.
Good metrics should be measured consistently,are inexpensive to collect,
areexpressednumerically,haveunitsofmeasure,andhavespeciccontext
[1]. We meet this challenge by capturing vulnerability interdependencies
and measuring security in the exact way that real attackers penetrate the
network. Ourmethodologyforsecurityriskanalysisisbasedonthemodel
ofattackgraphs.Weanalyzeallattackpathsthroughanetwork,providing
a probabilistic metric of the overall system risk. Through this metric, we
analyze tradeoffs between security costs and security benets. Decision
makerscanthereforeavoidoverinvestinginsecuritymeasuresthatdonot
payoff,orunderinvestingandriskdevastatingconsequences. Ourmetric
isconsistent,unambiguous,andprovidescontextforunderstandingsecurity
riskofcomputernetworks.
In FY 2008 we developed models that combined attack graphs and CVSS
scorestodeterminethesecurityriskofenterprisenetworks.Severalpapers
werepublishedinconferencesandworkshopsbasedonthiswork].InFY2009
weplantodoaproofofconceptimplementationtovalidateourresultsand
publishourresultsinconferences.
Contact:Dr.AnoopSinghal
(301)975-4432
Anoop.singhal@nist.gov
39

2 0 0 8 A N N U A L R E P O R T
Automated Vulnerability Management
National Vulnerability Database (NVD)
TheNationalVulnerabilityDatabase(NVD)istheUnitedStatesGovernment
repositoryofstandards-basedvulnerabilitymanagementreferencedata.The
NVDmakesavailableinformationonvulnerabilities,impactmeasurements,
detectiontechniques,andremediationassistance.Itprovidesthenecessary
referencedatathatenablestheSecurityContentAutomationProtocol(SCAP)
securityautomationcapabilities.AsofSeptember2008,NVDcontainedthe
followingresources:
Over32,000vulnerabilityadvisorieswithanaverageof11newvulner-
abilitiesaddeddaily;
22SCAPchecklistscontainingthousandsoflow-levelsecuritycongu-
ration checks that can be automatically processed by commercial
tools;
129 non-SCAP capable checklists (i.e., English prose guidance and
congurationscripts);
151US-CERT(U.S.ComputerEmergencyReadinessTeam)alerts,2262
US-CERT vulnerability summaries, and 2097 SCAP machine-readable
software-awchecks;
theemergingindustrystandardproductdictionarywith15,558entries;
and
17,022vulnerabilityadvisoriestranslatedintoSpanish.
NVDissponsoredbytheDepartmentofHomelandSecuritysNationalCyber
SecurityDivisionandtheNationalSecurityAgency.
NVDisthesecondmostpopularwebsiteatNIST,onlybehindtheNISTatomic
clock web site. The NVD receives approximately 69 million hits per year.
NVDseffectivereachisextendedbyitssecuritydatabeingincorporatedinto
manycommercialsecurityproducts(e.g.,McAfeeandSymantec).Justoneof
theseproductsisusedbyanestimated75,000organizationsworldwide.The
scopeofvendoradoptionisshownbyNVDXMLfeeds,whichpowerNVD-
basedproducts,beingdownloadedanaverageof2900timesaday.
NVD also plays a pivotal role in the Payment Card Industry (PCI) in their
effortstomitigatevulnerabilitiesincreditcardsystems.PCIhasmandated
that NVDs vulnerability severity scores be used for measuring the risk to
paymentcardserversworld-wideandfordeterminingwhichvulnerabilities
mustbexed.PCIsuseofNVDincreasesthesecurityofcreditcardtransac-
tionsandprotectsconsumerspersonalinformation.
Further, NVD is a core and critical element in the strategy to secure the
Department of Defense (DOD) in their Computer Network Defense (CND)
initiative.DODvulnerabilitymanagementservicesareintegratingwithNVD
andNVDisbeingmirroredonclassiednetworks.
InFY2008,NVDmaintaineditswidelyusedvulnerabilityreferencedatawhile
expanding its support of security checklists,SCAP,and the Department of
DefenseCNDinitiative.AccomplishmentsundertheNVDprogramincluded
authoring the emerging industry standard product dictionary, moving the
NationalChecklistProgramunderNVD,creatingNVDwebservices,offering
newvulnerabilitydatafeeds,andmigratingtoafaster,morerobustserver
architectureandcodebase.
NVDdataisafundamentalcomponentofmodernsecurityinfrastructureand
issubstantiallyincreasingthesecurityofnetworksworldwide.TheComputer
SecurityDivisionplanstoexpandandimprovetheNVDinFY2009.
http://nvd.nist.gov
Contact:Mr.PeterMell
(301)975-5572
peter.mell@nist.gov
Security Conguration Checklists for Commercial IT Products
Therearemanythreatstouserscomputers,rangingfromremotelylaunched
networkserviceexploitstomaliciouscodespreadthroughemails,malicious
websites, anddownloadsofinfectedles. Vulnerabilitiesininformationtech-
nology (IT) products are discovered daily,and many ready-to-use exploita-
tiontechniquesarewidelyavailableontheInternet.BecauseITproductsare
oftenintendedforawidevarietyofaudiences,restrictivesecuritycongura-
tioncontrolsareusuallynotenabledbydefault,somanyout-of-the-boxIT
products are immediately vulnerable.In addition,identifying a reasonable
setofsecuritysettingsformanyITproductsisacomplicated,arduous,and
time-consumingtask,evenforexperiencedsystemadministrators.
Although the solutions to IT security are complex,one basic but effective
toolisasecuritycongurationchecklist.Asecuritychecklistisadocument
thatcontainsinstructionsforsecurelyconguringanITproductforanopera-
tionalenvironmentorverifyingthatanITproducthasalreadybeensecurely
congured. Whenever feasible, organizations should apply checklists to
operatingsystemsandapplicationstoreducethenumberofvulnerabilities
thatattackerscanattempttoexploitandtolessentheimpactofsuccessful
attacks.Theuseofchecklistsimprovestheconsistencyandpredictabilityof
system security.There is no checklist that can make a system or product
100%secure,andusingchecklistsdoesnoteliminatetheneedforongoing
security maintenance, such as patch installation. However, organizations
canreducethenumberofwaysinwhichtheirsystemscanbeattackedand
40

achievegreaterlevelsofproductsecurityandprotectionfromfuturethreats
by using checklists that emphasize hardening of systems against software
aws(e.g.,byapplyingpatchesandeliminatingunnecessaryfunctionality)
andconguringsystemssecurely.
Acentralchecklistrepositorycanhelporganizationsndsecuritychecklists
that provide the appropriate level of security to determine if the checklist
iscurrentandobtaininformationabouthowthechecklistshouldbeimple-
mented.
TofacilitatedevelopmentofsecuritycongurationchecklistsforITproducts
and to make checklists more organized and usable, NIST established the
NationalChecklistProgram.ThegoalsoftheNCPareto
Facilitatedevelopmentandsharingofchecklistsbyprovidingaformal
frameworkforvendorsandotherchecklistdeveloperstosubmitcheck-
liststoNIST
Provideguidancetodeveloperstohelpthemcreatestandardized,high-
qualitycheckliststhatconformtocommonoperationalenvironments
Help developers and users by providing guidelines for making check-
listsbetterdocumentedandmoreusable
Encouragesoftwarevendorsandotherpartiestodevelopchecklists
Provide a managed process for the review,update,and maintenance
ofchecklists
Provideaneasy-to-userepositoryofchecklists
Providechecklistcontentinastandardizedformat
Encouragetheuseofautomationtechnologiesforchecklistapplication
suchastheSecurityContentAutomationProtocol(SCAP).
Checklists can take many forms,including les that can automatically set
or verify security congurations. Having such automated methods has
becomeincreasinglyimportantforseveralreasons,includingthecomplexity
of achieving compliance with various laws, Executive Orders, directives,
policies, regulations, standards, and guidance; the increasing number of
vulnerabilities in information systems; and the growing sophistication of
threats against those vulnerabilities.Automation is also needed to ensure
thatthesecuritycontrolsandcongurationsettingsareappliedconsistently
within an information system, and that the controls and settings can be
effectivelyveried.
The SCAP program addresses these needs by enabling standards based
security tools to automatically perform conguration checking using NCP
checklists. Workingcloselywithgovernment,industry,andacademia,CSD
encourages the development of automated checklists, particularly those
that are compliant or compatible with XCCDF (Extensible Conguration
ChecklistDescriptionFormat)and/orOVAL(OpenVulnerabilityandAssess-
ment Language).These are widely used for automated checklistsXCCDF
primarilyformappingpoliciesandothersetsofrequirementstohigh-level
technicalchecks,andOVALprimarilyformappinghigh-leveltechnicalchecks
tothelow-leveldetailsofexecutingthosechecksontheoperatingsystems
orapplicationsbeingassessed.
Thereare130checklistspostedonthewebsite;25ofthechecklistsareSCAP-
expressed and can be used by SCAP-validated software tools. This allows
organizationstousechecklistsobtainedfromtheCSDwebsite(checklists.
nist.gov)forautomatedsecuritycongurationandpatchingwithoutvendor
interaction. Some vendors, including Microsoft Corporation and RedHat
provide SCAP checklists content to the NCP, while most of the checklists
come from government organizations,not-for-prot,and Federally Funded
Research and Development Centers (FFRDCs). NCP currently has SCAP
checklistsforWindowsVista,Windows2003Server,WindowsXP,Windows
41

2 0 0 8 A N N U A L R E P O R T
2000,Ofce2007,InternetExplorer7.0,RedHatLinux,AIX,HPUX,Symantec
AntiVirus,McAfeeAntiVirus,andotherproducts.
Federalagenciesarerequiredtousesecuritycongurationchecklistsfromthe
NCP. InFebruary2008,revisedPart39oftheFederalAcquisitionRegulation
(FAR)waspublished. Paragraph(d)ofsection39.101states,Inacquiring
information technology, agencies shall include the appropriate IT security
policies and requirements, including use of common security congura-
tions available from the NIST website at http://checklists.nist.gov.Agency
contractingofcersshouldconsultwiththerequiringofcialtoensurethe
appropriatestandardsareincorporated.
InFY2008NISTannouncedthecompletionofSCAPversion1.0;developed
the Federal Desktop Core Conguration (FDCC) checklists; hosted the 4th
AnnualSecurityAutomationConference,drawingnearly800attendees,and
anFDCCworkshopdrawingover700attendees;andfurtherintegratedthe
NCP website with the NIST National Vulnerability Database (NVD). NIST
personnel also both visited and hosted a number of software vendors to
encourageparticipationinthechecklistprogram.
Inscalyear2009,CSDwillcompleteactivitiestoevolvetheNVDtoproduc-
tionreadinessforSCAPversion2.0;weplantoannouncethereadinessof
the NVD to support SCAP version 2.0 and associated standards. CSD will
also communicate SCAP standards and guidelines through a combination
of NISTIRs and SPs, and continue education and awareness activities.We
also plan to continue beta test and production support and to provide an
automatedweb-basedfeedfromtheNCPwebsite.
http://checklists.nist.gov
Contact:Mr.StephenQuinn
(301)975-6967
stephen.quinn@nist.gov
Security Content Automation Protocol (SCAP) Validation
Program
The Security Content Automation Protocol (SCAP) Validation Program
performsconformancetestingtoensurethatproductscorrectlyimplement
SCAP.Conformance testing is necessary because SCAP is a complex speci-
cation consisting of six vulnerability management specications.A single
error in product implementation could result in undetected vulnerabilities
withinagencyandindustrynetworks.
TheSCAPValidationProgramwascreatedonrequestbytheOfceofManage-
ment and Budget (OMB) to support the Federal Desktop Core Conguration
(FDCC).TheSCAPprogramworkswiththeNISTNationalVoluntaryLaboratory
Accreditation Program (NVLAP) to set up independent conformance testing
laboratories. Due to the need to support FDCC quickly, the SCAP validation
program was created in just six months and was deployed February 2008.
Withinthersteightmonthsofoperation,theprogramaccreditedninetesting
laboratoriesandvalidated17productsfrom11vendors.
While FDCC SCAP testing is an important part of the program, it is only
one of seven different SCAP capabilities which vendors can apply to test
their products.The others cover product capabilities such as conguration
scanning, vulnerability scanning, patch checking, remediation capabilities,
andvulnerabilitydatabases.Inaddition,productvendorscantesttheconfor-
manceoftheirproductstoeachofthesixspecicationsthatmakeupSCAP,
independentoftheproductsoverallSCAPvalidation.Thisprogramhasbeen
popular,resulting in the award of 70 capability validations to the 17 vali-
datedproducts(anaverageof4capabilitiesperproduct).
Use of SCAP validation has already expanded beyond FDCC.The General
ServicesAdministration (GSA) SmartBUY program is conducting enterprise
wide blanket purchase agreements for vulnerability and conguration
scanners. This procurement mandates SCAP validation for participating
products. TheDODComputerNetworkDefense(CND)initiativealsorelieson
SCAPvalidationforthefutureDODcybersecuritystrategy.
SCAPhasbeendesignedtobeinexpensive,yeteffective.TheSCAPconfor-
mancetestsareeithereasilyhumanveriableorautomatedthroughNIST
providedreferencetools.
TheSCAPValidationProgramwillcontinuetooperateinFY2009. Itwillexpand
toincludeadditionalcapabilities,willprovideenhancedtestingsupport,and
willevolvetoincludenewtechnologiesasSCAPitselfmatures.
http://nvd.nist.gov/validation.cfm
Contact:Mr.PeterMell
(301)975-5572
peter.mell@nist.gov
Infrastructure Services, Protocols, And Applications
Border Gateway Protocol
TheBorderGatewayProtocol(BGP)isaninter-autonomoussystemrouting
protocol. Anautonomoussystemisanetworkorgroupofnetworksunder
a common administration and with common routing policies.BGP is used
to exchange routing information for the Internet and is the protocol used
betweenInternetserviceproviders(ISPs).
The BGP project was initiated in February 2004. The project aims to help
industry to understand the potential risks to inter-domain routing and the
42

design and implementation trade-offs of the various BGP security mecha-
nisms currently proposed in the Internet Engineering Task Force (IETF)
community. Previously,therewasalackofawarenessandknowledgeinthe
informationtechnology(IT)sectorofthepotentialthreats,risks,mitigation
techniques,andtheircosts. Theprojectalsoseekstoexpediteconvergence
towardsstandardized,implemented,anddeployedBGPsecuritysolutions.
Our project efforts continue to focus on characterizing the problem and
design space for BGP security technologies. Our subsequent work has
focused primarily on two activities large-scale simulation modeling of
focused BGP attacks and analytical models of threat versus countermea-
sureeffectiveness. Weareworkingwithindustryandgovernmentnetwork
operatorsandsecurityexpertsto
IdentifythethreatsandvulnerabilitiesofBGP/inter-domainrouting;
DocumentbestcommonpracticesinsecuringthecurrentBGPdeploy-
ments;and
Provide deployment and policy guidance for emerging BGP security
technologies.
InJune2007,weissuedNISTSpecialPublication(SP)800-54, BorderGateway
ProtocolSecurity,toprovideaguidelineofbestpracticesforsecuringBGP.
Work on updating and extending this publication was initiated in FY2008
andwillbecompletedwithanewreleaseinFY2009.
http://www.antd.nist.gov/iipp.shtml
Contacts:Mr.RickKuhn Mr.DouglasMontgomery(ANTD)
(301)975-3337 (301)975-3630
kuhn@nist.gov dougm@nist.gov
Guide to Secure Sockets Layer (SSL) Virtual Private
Networks (VPNs)
SecureSocketsLayer(SSL)virtualprivatenetworks(VPNs)provideuserswith
secureremoteaccesstoanorganizationsresources. AnSSLVPNconsistsof
oneormoreVPNdevicestowhichusersconnectusingtheirWebbrowsers.
ThetrafcbetweentheWebbrowserandSSLVPNdeviceisencryptedwith
the SSL protocol. SSLVPNs can provide remote users with access toWeb
applicationsandclient/serverapplications,aswellasconnectivitytointernal
networks. They offer versatility and ease of use because they use the SSL
protocol,whichisincludedwithallstandardWebbrowsers,sospecialclient
congurationorinstallationisoftennotrequired. InplanningVPNdeploy-
ment, many organizations are faced with a choice between an Internet
Protocol Security (IPSec) based VPN and an SSL-based VPN. In 2005, we
publishedNISTSP800-77,GuidetoIPSecVPNs.
Acomplementarydocument,SP800-113,GuidetoSSLVPNs,waspublished
in July 2008. It seeks to assist organizations in understanding SSL VPN
technologies.The publication also makes recommendations for designing,
implementing,conguring,securing,monitoring,and maintaining SSLVPN
solutions.SP800-113providesaphasedapproachtoSSLVPNplanningand
implementationthatcanhelpinachievingsuccessfulSSLVPNdeployments.
ItalsoincludesacomparisonwithothersimilartechnologiessuchasIPSec
VPNsandotherVPNsolutions.
Contact:Ms.SheilaFrankel
(301)975-3297
sheila.frankel@nist.gov
Internet Protocol Version 6 (IPv6) and Internet Protocol Security
(IPsec)
The Internet ProtocolVersion 6 (IPv6) is an updated version of the current
Internet Protocol, IPv4. It has been, and continues to be, developed and
denedbytheInternetEngineeringTaskForce(IETF)inaseriesofconsensus-
based standards documentsRequests for Comment (RFCs), which are
approvedstandardsdocuments,andInternetDrafts(IDs),whichareworks-
in-progressthatmayprogresstobecomestandards.Thesedocumentsdene
thecontentsandbehaviorofnetworkcommunicationsateverylevelofthe
networkingstack,fromapplicationsdowntothephysicallayer.
The primary motivations for the development of IPv6 were to increase the
numberofuniqueIPaddressesandtohandletheneedsofnewInternetappli-
cationsanddevices.Inaddition,IPv6wasdesignedwiththefollowinggoals:
increased ease of network management and conguration,expandable IP
headers,improvedmobilityandsecurity,andqualityofservicecontrols.
TheUnitedStatesOfceofManagementandBudget(OMB)mandatedthat
government agencies should incorporate IPv6 capability into their back-
bones(routers,gateways,etc.)by2008.NISTpersonnelactivelyparticipated
inthefederalIPv6WorkingGroup,formedtohelpgovernmentagenciesplan
andexecutethetransitioninaninteroperableandsecuremanner.Wealso
developed an IPv6 prole to dene which pieces and features of IPv6 are
mandatory for government agencies,which are optional,and where these
elementsaredenitivelydened. Atestandconformityassessmentprogram
isalsointheplanningstage.
Internet Protocol Security (IPsec) is a framework of open standards for
ensuring private communications over IP networks,which has become the
most popular network layer security control. It can provide several types
of data protectioncondentiality; integrity; data origin authentication;
prevention of packet replay and trafc analysis; and access control. IPsec
43

2 0 0 8 A N N U A L R E P O R T
typically uses the Internet Key Exchange (IKE) protocol to negotiate IPsec
connection settings, exchange keys, authenticate endpoints to each other,
and establish security associations, which dene the security of IPsec-
protectedconnections. IPsecandIKEwereaddedtoIPv4afterthefact,but
arenowintegratedintoallofthemajoroperatingsystems.ForIPv6,IPsec
andIKEareplannedtobeanintegralpartofthenetworkprotocols.
IPsechasseveraluses,withthemostcommonbeingavirtualprivatenetwork
(VPN). Thisisavirtualnetworkbuiltontopofexistingphysicalnetworksthat
canprovideasecurecommunicationsmechanismfordataandIPinforma-
tiontransmittedbetweennetworks.AlthoughVPNscanreducetherisksof
networking,theycannottotallyeliminatethem.Forexample,aVPNimple-
mentationmayhaveawsinalgorithmsorsoftware,orinsecurecongura-
tionsettingsandvaluesthatattackerscanexploit.
Special Publication (SP) 500-267, A Prole for IPv6 in the United States
Government -Version 1.0,was published in July 2008.This document is a
proletoassistfederalagenciesindevelopingplanstoacquireanddeploy
products that implement Internet Protocol version 6 (IPv6). The prole
recommendsIPv6capabilitiesforcommonnetworkdevices,includinghosts,
routers,intrusiondetectionsystems,andrewalls,andincludesaselectionof
IPv6standardsandspecicationsneededtomeettheminimumoperational
requirementsofmostfederalagencies.Itwasdevelopedtohelpensurethat
IPv6-enabledfederalinformationsystemsareinteroperableandsecureand
addresseshowsuchsystemscaninteroperateandcoexistwiththecurrent
IPv4 systems.Agencies with unique information technology requirements
areexpectedtousetheNISTproleasabasisforfurtherrenedspecica-
tionsandpolicies.
AguidancedocumentonIPv6andIPsec,SP800-119, GuidancefortheSecure
AdoptionofIPv6,isplannedforFY2009.ThisdocumentwilldescribeIPv6s
new and expanded protocols,services,and capabilities.It will characterize
newsecuritythreatsposedbythetransitiontoIPv6.Itwillissueguidance
on IPv6 deployment, including transition, integration, conguration, and
testing. It will also include several practical IPv6 transition scenarios. In
addition,ourpersonnelareconductingresearchonthechallengesposedto
intrusiondetectionsystems(IDSs)andrewallsbyaddingIPv6tonetworks.
Contacts:Ms.SheilaFrankel Mr.DouglasMontgomery(ANTD)
(301)975-3297 (301)975-3630
sheila.frankel@nist.gov dougm@nist.gov
Securing the Domain Name System (DNS)
TheDomainNameSystem(DNS)isthemethodbywhichInternetaddresses
inmnemonicformsuchashttp://csrc.nist.gov areconvertedintotheequiv-
alentnumericIP(InternetProtocol)addressessuchas129.6.13.39.Certain
servers throughout the world maintain the databases needed, as well as
performthetranslations. ADNSserverthatisperformingatranslationmay
communicate with other Internet DNS servers if it does not have the data
neededtotranslatetheaddressitself.
As are other Internet-based systems, DNS is subject to several threats.To
counterthesethreats,theInternetEngineeringTaskForce(IETF)aninter-
nationalstandardsbodydevelopedasetofspecicationsforsecuringDNS
called DNS Security Extensions (DNSSEC). In partnership with the Depart-
mentofHomelandSecurity,wehavebeenactivelyinvolvedinpromotingthe
deploymentofDNSSECsince2004.
44

Aspartofthiscontinuingeffort,wepublishedguidelinesforDNSSECdeploy-
mentinSpecialPublication(SP)800-81,SecureDomainNameSystem(DNS)
DeploymentGuide,inMay2006. Thisguidancedocumentformedthecore
materialforaseriesofworkshopsheldatNISTforUSGDNSadministrators
to demonstrate basic DNSSEC deployment steps and explain how DNSSEC
changesthewayanagencymaintainsitsDNS.
NISTalsoexpandedtheSecureNamingInfrastructurePilot(SNIP)inFY2008
tomeetthefollowinggoals,whichwereestablishedwhentheSNIPdomain
wasrstdeployed:
To enable United States government DNS stakeholders to become
familiar with DNSSEC and to understand its impact on current DNS
operations.
To deploy and test new DNSSEC tools,implementations and applica-
tionsastheybecomeavailable. Vendorsareencouragedtoworkwith
the SNIP testbed as a means to demonstrate and evaluate DNSSEC
enabledsoftwareinasignedinfrastructure.
Tobeusedasapersistent,signedinfrastructureforusewithNISTspon-
soredDNSSECworkshopsforUSGDNSadministrators.
InFY2008,toolsfromSpartaIncandSecure64weredeployedontheSNIP
as new DNSSEC enabled software and hardware. In addition,in FY 2008,
we also published a new white paper on deploying new cryptographic
algorithms in DNSSEC and made it available on the NIST DNSSEC project
webpage (http://www-x.antd.nist.gov/dnssec). This document lays out
the roadmap of cryptographic guidelines within the United States Federal
GovernmentandtheexpectedimpactonDNSSEC,anditprovidesalistof
stepsforDNSadministratorstousewhendeployingnewcryptographicalgo-
rithmstoasignedzone. Weexpecttointegratethisworkintoarevisionof
NISTSP800-81inFY2009.
NIST continued efforts with the United States General Services Adminis-
tration (GSA) to set in motion the process for securing the top-most DNS
domain of the United States Government (i.e., .gov). NIST is tracking the
progressofDNSSECimplementationsinseveralDNSservers/productsandis
planningtoupdatetheSP800-81documenttocoverthesetechnologies. The
update will include guidelines for secure conguration and deployment of
newsecurityfeaturesspeciedwithDNSSECsuchasthenewHashedNext
Secure(NSEC3)RRanddeploymentofnewdigitalsigningalgorithms. NIST
is also working with standards organizations to ensure that the DNSSEC
specications keep up with current best security practices with regards to
cryptographic algorithm deployment options and cryptographic key sizes.
Thesenewcryptographicalgorithm,keylifetimeandkeysizeparameterswill
beincludedinPart3ofNISTSP800-57,RecommendationforKeyManage-
ment,whichwillbeissuedforpubliccommentsinFY2009. Weworkedwith
theeditorsteamforPart3duringFY2008toprovideasetofrecommenda-
tionsforkeymanagementinDNSSECbasedonthekeymanagementfoun-
dationspublishedinPart1ofSP800-57.TherecommendationsinSP800-57
Part3differfromtherecommendationsofSP800-81andweplantorevise
SP800-81tobringitsrecommendationsinlinewithwhatisdescribedinSP
800-57Parts1and3.
Contacts:Dr.RamaswamyChandramouli Mr.ScottRose(ANTD)
(301)975-5013 (301)975-8439
mouli@nist.gov scott.rose@nist.gov
Voice over Internet Protocol Security Issues
Voice over IP (VoIP)the transmission of voice over packet-switched IP
networksisoneofthemostimportanttrendsintelecommunications. VoIP
providesacheaper,clearer,andmoreexiblealternativetotraditionalPublic
SwitchedTelephone Network (PSTN) telephone lines. In addition to tele-
phone handsets and other end-user equipment,VoIP systems include call
processors/call managers, gateways, routers, and rewalls. Most of these
componentshavecounterpartsusedindatanetworks,buttheperformance
demandsofVoIPandtheneedtosupportcriticalservices,suchasEmergency
911,meanthatordinarysoftwareandhardwaremustbesupplementedwith
specialVoIPcomponents.
Those new to VoIP might assume that because digitized voice travels in
packets just like other data, existing network architectures and tools can
beusedwithoutchange.However,VoIPaddsanumberofcomplicationsto
existingnetworktechnology,andtheseproblemsaremagniedbysecurity
considerations. QualityofService(QoS)isfundamentaltotheoperationofa
VoIPnetworkthatmeetsusersqualityexpectations.However,theimplemen-
tationofsecuritymeasurescancauseamarkeddeteriorationinQoSunless
VoIP-specic equipment and architectures are used. These complications
rangefromrewallsdelayingorblockingcallsetupstoencryption-produced
latencyanddelayvariation(jitter).Becauseofthetime-criticalnatureofVoIP
anditslowtolerancefordisruptionandpacketloss,manysecuritymeasures
implementedintraditionaldatanetworksmustbespecializedforVoIP.
AnotherimportantsecurityconsiderationforVoIPisthatvoicecommunications
mustbeprotected. Inaconventionalofcetelephonesystem,intercepting
conversations requires physical access to telephone lines or compromise of
theofceprivatebranchexchange(PBX);asaresult,onlyparticularlysecu-
rity-sensitive organizations encrypt voice trafc over traditional telephone
lines.The same cannot be said for Internet-basedVoIP connectionssuch
a connection may pass through more than a dozen systems that are under
third-partycontrol,anyoneofwhichcouldmonitoraconversation.Whena
45

2 0 0 8 A N N U A L R E P O R T
personvisitsaretailerontheInternetandprovidesacreditcardnumberand
othersensitiveinformation,itisprotected;likewise,sensitiveVoIPcommuni-
cationsontheInternetshouldbesimilarlyprotected.
During FY2008, CSD continued to update SP 800-58, Security Consider-
ationsforVoiceOverIPSystems,whichhadbeenpublishedinJanuary2005.
ThispublicationinvestigatestheattacksanddefensesrelevanttoVoIPand
exploreswaystoprovideappropriatelevelsofsecurityforVoIPnetworksat
reasonablecost. Theupdatedpublicationwillreectchangesintechnology,
potentialinteractionsbetweenprotocolfeaturesthatcouldresultinsecurity
weaknesses,revisionsofstandards,andnewapplicationsofVoIPandrelated
technologies,suchasvideooverInternet. ThenewversionofSP800-58is
expectedtobereleasedforpubliccommentinFY2009.
Contacts:Ms.KarenScarfone Mr.RickKuhn
(301)975-8136 (301)975-3337
karen.scarfone@nist.gov kuhn@nist.gov
Wireless Security Standards
Wirelesscommunicationsanddevicesareconvenient,exible,andeasyto
use.Usersofwirelesslocalareanetwork(WLAN)deviceshavetheexibility
tomovefromoneplacetoanotherwhilemaintainingconnectivitywiththe
network.ThemostwidelyusedWLANdevicestodayarebasedontheInsti-
tuteofElectricalandElectronicsEngineers(IEEE)802.11standard. Wireless
personalareanetworks(WPANs)allowuserstosharedataandapplications
betweendeviceswithoutusingcablesorotherphysicalconnections.WPANs
areusedforcellphones,PDAs,keyboards,mice,printers,andothertypesof
devices.
While wireless networks are exposed to many of the same risks as wired
networks,theyarevulnerabletoadditionalrisksaswell.Wirelessnetworks
transmit data through radio frequencies and are open to intruders unless
protected. Intruders have exploited this openness to access systems and
services, destroy and steal data, and launch attacks that tie up network
bandwidthanddenyservicetoauthorizedusers.
Thispastyear,wecompletedtwoSpecialPublicationsdealingwithwireless
security issues.The rst, SP 800-48 Revision 1, Guide to Securing Legacy
IEEE 802.11Wireless Networks, was published in July 2008. It describes
the inherent aws in legacy IEEE 802.11 WLAN technologies. It provides
recommendations for applying compensating controls to mitigate these
aws,anditdiscussesthevalueofmigratingtonewerIEEE802.11technolo-
giesthatarebasedonversionsoftheIEEE802.11standardandthatoffer
muchstrongersecuritycapabilities.SP800-48Revision1isanupdatetothe
originalversionofSP800-48,whichwaspublishedin2002.
ThesecondpublicationonwirelesssecurityissuedinFY2008isSP800-121,
Guide to Bluetooth Security. It discusses the security capabilities and
shortcomings of the most recent versions of the Bluetooth specication
forWPANs, and it describes several common vulnerabilities of Bluetooth-
enabled devices. SP 800-121 recommends how organizations employing
Bluetoothtechnologiescansecurethemeffectivelyagainstcommonattacks.
SP800-121,whichwaspublishedinSeptember2008,replacestheBluetooth
sectionoftheoriginalSP800-48issuedin2002.
CSDhasalsorecentlybegunworkonapublicationonwirelessmetropolitan
area network (WLAN) security, specically considerations for Worldwide
InteroperabilityforMicrowaveAccess(WiMAX)technologies. Weexpectto
releaseaNISTSPonWiMAXsecurityduringFY2009.
Contact:Ms.KarenScarfone
(301)975-8136
karen.scarfone@nist.gov
CSDs Part in National and International
IT Security Standards Processes
TheInternationalOrganizationforStandardization(ISO)isanetworkofthe
nationalstandardsinstitutesof148countries,withtherepresentationofone
member per country. The scope of ISO covers standardization in all elds
exceptelectricalandelectronicengineeringstandards,whicharetherespon-
sibilityofIEC,theInternationalElectrotechnicalCommission.
TheIECpreparesandpublishesinternationalstandardsforallelectrical,elec-
tronic,and related technologies,including electronics,magnetics and elec-
tromagnetics,electroacoustics,multimedia,telecommunication,andenergy
production and distribution,as well as associated general disciplines such
as terminology and symbols, electromagnetic compatibility, measurement
and performance, dependability, design and development, safety, and the
environment.
JointTechnicalCommittee1(JTC1)wasformedbyISOandIECtoberespon-
sibleforinternationalstandardizationintheeldofInformationTechnology.
It develops, maintains, promotes, and facilitates IT standards required by
globalmarketsmeetingbusinessanduserrequirementsconcerning
designanddevelopmentofITsystemsandtools
performanceandqualityofITproductsandsystems
securityofITsystemsandinformation
portabilityofapplicationprograms
46

interoperabilityofITproductsandsystems
uniedtoolsandenvironments
harmonizedITvocabulary
user-friendlyandergonomicallydesigneduserinterfaces.
JTC1consistsofanumberofsubcommittees(SCs)andworkinggroupsthat
address specic technologies. SCs that produce standards relating to IT
securityinclude:
SC 06 - Telecommunications and Information Exchange Between
Systems
SC17-CardsandPersonalIdentication
SC27-ITSecurityTechniques
SC37-Biometrics
JTC1alsohas
TechnicalCommittee68FinancialServices
SC2-OperationsandProceduresincludingSecurity
SC4-Securities
SC6-FinancialTransactionCards,RelatedMediaandOperations
SC7-CoreBanking
AmericanNationalStandardsInstitute(ANSI)isaprivate,nonprotorgani-
zation(501(c)(3))thatadministersandcoordinatestheUnitedStatesvolun-
tarystandardizationandconformityassessmentsystem.
National Standardization
ANSIfacilitatesthedevelopmentofAmericanNationalStandards(ANSs)by
accrediting the procedures of standards-developing organizations (SDOs).
TheInterNationalCommitteeforInformationTechnologyStandards(INCITS)
isaccreditedbyANSI.
International Standardization
ANSIpromotestheuseofUnitedStatesstandardsinternationally,advocates
United States policy and technical positions in international and regional
standards organizations, and encourages the adoption of international
standards as national standards where they meet the needs of the user
community.
ANSIisthesoleUnitedStatesrepresentativeanddues-payingmemberofthe
twomajornon-treatyinternationalstandardsorganizations,ISOand,viathe
UnitedStatesNationalCommittee(USNC),theIEC.
INCITSservesastheANSITechnicalAdvisoryGroup(TAG)forISO/IECJoint
TechnicalCommittee1. INCITSissponsoredbytheInformationTechnology
Industry (ITI) Council, a trade association representing the leading United
States providers of information technology products and services. INCITS
currentlyhasmorethan750publishedstandards.
INCITSisorganizedintoTechnicalCommitteesthatfocusonthecreationof
standardsfordifferenttechnologyareas.Technicalcommitteesthatfocuson
ITsecurityandITsecurity-relatedtechnologiesinclude:
B10IdenticationCardsandRelatedDevices
CS1CyberSecurity
E22ItemAuthentication
M1Biometrics
T3OpenDistributedProcessing(ODP)
T6RadioFrequencyIdentication(RFID)Technology
As a technical committee of INCITS,CS1 develops United States national,
ANSI-accredited standards in the area of cyber security. Its scope encom-
passes
Managementofinformationsecurityandsystems
Managementofthird-partyinformationsecurityserviceproviders
Intrusiondetection
Networksecurity
Incidenthandling
ITsecurityevaluationandassurance
Securityassessmentofoperationalsystems
Securityrequirementsforcryptographicmodules
Protectionproles
Role-basedaccesscontrol
Securitychecklists
Securitymetrics
47
2 0 0 8 A N N U A L R E P O R T
Cryptographic and non-cryptographic techniques and mechanisms Test Requirements for Cryptographic Modules,andAllen Roginsky of NIST,
including: Co-Editoron29150,Signcryption. AllinputfromCS1goesthroughINCITS
condentiality
entityauthentication
non-repudiation
keymanagement
dataintegrity
messageauthentication
hashfunctions
digitalsignatures
Futureserviceandapplicationsstandardssupportingtheimplementa-
tionofcontrolobjectivesandcontrolsasdenedinISO27001,inthe
areasof
businesscontinuity
outsourcing
Identitymanagement,including:
identitymanagementframework
role-basedaccesscontrol
singlesign-on
Privacytechnologies,including:
privacyframework
privacyreferencearchitecture
privacyinfrastructure
anonymityandcredentials
specicprivacyenhancingtechnologies.
The scope of CS1 explicitly excludes the areas of work on cyber security
standardization presently underway in INCITS B10, M1,T3,T10 and T11;
as well as other standard groups,such as theAlliance forTelecommunica-
tionsIndustrySolutions,theInstituteofElectricalandElectronicsEngineers,
Inc.,the Internet EngineeringTask Force,theTravel IndustryAssociation of
America,andAccreditedStandardsCommittee(ASC)X9. TheCS1scopeof
work includes standardization in most of the same cyber security areas as
arecoveredintheNISTComputerSecurityDivision.
AstheUnitedStatesTAGtoISO/IECJTC1/SC27,CS1contributestotheSC27
programofworkonITSecurityTechniquesinterms,comments,andcontri-
butionsonSC27standardsprojects;votesonSC27standardsdocuments
atvariousstagesofdevelopment;andidentifyingUnitedStatesexpertsto
workonvariousSC27projectsortoserveinvariousSC27leadershipposi-
tions. Currently10CS1membersareSC27documenteditorsorcoeditorson
variousstandardsprojects,includingRandyEasterofNISTforISO/IEC24759,
toANSI,thentoSC27. ItisalsoaconduitforgettingUnitedStates-based
new work item proposals and United States-developed national standards
intotheinternationalSC27standardsdevelopmentprocess.CS1ismaking
contributionsonseveralnewareasofworkinSC27,includingstudyperiods
and/ornewworkitemproposalsonSecretsharingmechanisms,Keyestab-
lishmentmechanismsformultipleentities,CategorizationandClassication
of Information Security Incidents, Light-weight cryptographic mechanisms,
OIDandASN.1,Informationsecuritygovernance,Evidenceacquisitionproce-
durefordigitalforensics,andinformationsecurityforcriticalinfrastructure
Sector-specicguidance.
ThroughitsmembershiponCS1,whereDanBenigniservesasthenonvoting
chair,andRichardKisselistheNISTPrimarywithvote,NISTcontributesto
all CS1 national and international IT security standards efforts. NIST can
also initiate IT security-related projects for national or international stan-
dardization through its membership on CS1. As an example, CSD staffer
DavidFerraiolohasaskedCS1toconsideranewfamilyofnationalstandards
concerninganaccesscontrolmechanismthatcanbeembeddedintooper-
atingsystems,calledthePolicyMachine.
DanBenignialsoservesasCS1LiaisontotheINCITSStudyGrouponSecurity
BestPractices,whosecharteristostudythesecurityneedsandrequirements
of the nancial and insurance services industries, assess what is missing
in current standards and practices, and make recommendations on an
approach to create deployable best practices and frameworks for security
intheseindustries. ThisgrouphasproducedanewprojectproposalforSC
27toconsider,asector-specicISMSguidelinefortheFinancialServicesand
Insurance industries. This standard is intended to provide guidance to the
FinancialServicesandInsuranceIndustriesonhowtoadapt27002controls
and processes to specic regulatory and industry-mandated services and
legallybindingprocedures. CS1hasvotedtobringittoSC27forapproval
asanewstandardsproject.
DanwasalsoaLiaisontotherecentlycompletedjointstudyeffortorganized
by the American National Standards Institutes (ANSI) Homeland Security
Standards Panel (HSSP) and the Internet SecurityAlliance (ISA),where the
outputisasoontobepublishedActionGuide. ThisGuide,titledTheFinan-
cial Impact of Cyber Risk -- 50 Questions Every CFO ShouldAsk,provides
private sector enterprises the means to assess and address the nancial
exposure of cyber security from all angles. It is a tool the CFO (and often
otherexecutives)canusetobuildaframeworkforanalyzing,managingand
transferringtheNetFinancialRiskofcybersecurity.Asopposedtofocusing
ontechnologicalstandardsorevenbestpractices,thisguideispresentedto
furtheradvancetheunderstandingofnancialmanagement.
48

CS1hascreatedataskgroupcalledCS1.1RBAC,withanationalstandards
project called Requirements for the Implementation of Role-Based Access
Control(RBAC) INCITSProject1794. Thisstandardwillprovideimplementa-
tionrequirementsforRBACsystems,whichuseRBACcomponentsdenedin
INCITS359-2004. RBACwasoriginallydevelopedatNIST. Theimplementa-
tionrequirementsinthisstandardareintendedtoensuretheinterchangeof
RBACdata(e.g.,roles,permissions,users)andpromotefunctionalinteroper-
ability among RBAC services and applications. In Q2 of FY2009,this work
willbereadyforitsrstpublicreview. CS1hasalsoapprovedanewproject
to revise RBAC 359-2004, and has sent it to the INCITS Executive Board
forApproval. The revision will cover renements of the standard that may
include the following items: Role-role constraints:extend beyond dynamic
andstaticseparationofduty;Reectdistinctionbetweenstructuralrolesand
functionalroles;andReectsession-lessroleactivation.
In addition, CS1 has recently created another national standards project,
entitled Small Organization Baseline Information Security Handbook. This
standard will provide minimum guidance, leveraging the existing body of
knowledge,andprovidesufcientdetailthatsmallorganizationscanidentify
andaddresstheirmostimportantsecurityissues.Inaddition,thestandard
will provide pointers to key domestic and international security standards
andreferences. Thegoalistomakeinformationsecurityaccessibletosmall
businesses. By enhancing the general level of information security, it is a
contributiontotheoverallstabilityofnationalcriticalinfrastructure.
In its international efforts,CS1 has consistently,efciently,and in a timely
mannerrespondedtoallcallsforcontributionsonallinternationalsecurity
standardsprojectsinISO/IECJTC1SC27. ContributionsfromCS1members
havealsoincludedmanyNISTpublications. Forinstance,FIPS140-3,when
published,will become the basis for the Revision of ISO/IEC 19790:2006-
03-01(1stedition),Securityrequirementsforcryptographicmodules.
Contact:Mr.DanielBenigni
(301)975-3279
benigni@nist.gov
Systems and Network Security Technical Guidelines
The items below provide brief summaries of system and network security
technicalguidelinesreleasedforpubliccommentorasnalduringFY2008.
Securing Cell Phones and PDAs
SpecialPublication(SP)800-124,GuidelinesonCellPhoneandPDASecurity,
provides an overview of cell phone and personal digital assistant (PDA)
devices in use today. These devices can perform many functions done at
a desktop computer, may also have specialized built-in hardware such as
camerasandGlobalPositioningSystem(GPS)receivers,andofferarangeof
wirelessnetworkinterfaces,includinginfrared,wirelesslocalareanetwork,
Bluetooth, and one or more cellular interfaces. The publication offers
insights for making informed information technology security decisions on
theirtreatment,anditgivesdetailsaboutthethreats,technologyrisks,and
safeguardsforthesedevices. SP800-124wasreleasedforpubliccomment
inJuly2008.
Server Security
SP800-123,GuidetoGeneralServerSecurity,assistsorganizationsinunder-
standingthefundamentalactivitiesperformedaspartofsecuringandmain-
tainingthesecurityofservers. Thepublication,whichwaspublishedasnal
inJuly2008,discussestheneedtosecureserversandprovidesrecommen-
dationsforselecting,implementing,andmaintainingthenecessarysecurity
controls. Other NIST publications provide recommendations for particular
typesofservers. TherecommendationsinSP800-123areafoundationfor
otherserver-relatedpublicationsanddonotoverridemorespecicrecom-
mendationsmadeinsuchpublications.
Security for Bluetooth Devices
SP800-121,GuidetoBluetoothSecurity,providesinformationtoorganiza-
tionsonthesecuritycapabilitiesofBluetooth,whichisanopenstandardfor
short-range radio frequency (RF) communication. Bluetooth technology is
used primarily to establish wireless personal area networks (WPANs) used
bycellphones,personaldigitalassistants(PDAs),laptops,printers,andother
typesofdevicestoshareinformationandservices. SP800-121,whichwas
publishedasnalinSeptember2008,recommendshoworganizationsthat
employ Bluetooth technologies can secure them effectively. It supersedes
theBluetoothrecommendationsintheoriginalSP800-48,WirelessNetwork
Security:802.11,Bluetooth,andHandheldDevices.
Information Security Testing and Assessment
SP800-115,TechnicalGuidetoInformationSecurityTestingandAssessment,
was published as nal in September 2008. It provides guidelines to orga-
nizationsonplanningandconductingtechnicalinformationsecuritytesting
and assessments. It includes practical recommendations for designing,
implementing, and maintaining technical information relating to security
test and assessment processes and procedures. SP 800-115 presents an
overview of the key elements of technical security testing and assessment
withanemphasisonspecictechniques,theirbenetsandlimitations,and
recommendationsfortheiruse. ItreplacesSP800-42,GuidelineonNetwork
SecurityTesting,whichwasreleasedin2003.
49

2 0 0 8 A N N U A L R E P O R T
Securing External Telework Devices
SP 800-114, Users Guide to Securing External Devices for Telework and
Remote Access, helps teleworkers secure the external devices that they
usefortelework,suchaspersonallyowneddesktopandlaptopcomputers,
cellphones,andpersonaldigitalassistants(PDAs). Thepublication,which
waspublishedasnalinNovember2007,focusesonsecurityfortelework
involvingremoteaccesstoanorganizationsnonpubliccomputingresources.
It provides practical, real-world advice on securing telework computers
operatingsystemsandapplications,aswellasteleworkershomenetworks,
cellphones,PDAs,andotherconsumerdevices.Thepublicationalsoprovides
tips on considering the security of a device owned by a third party before
decidingwhetheritshouldbeusedfortelework.
SSL VPNs
SP800-113,GuidetoSSLVPNs,waspublishedasnalinJuly2008. Itassists
organizations in understanding Secure Sockets Layer (SSL) Virtual Private
Network (VPN) technologies.The publication makes recommendations for
designing,implementing,conguring,securing,monitoring,andmaintaining
SSL VPN solutions. SP 800-113 provides a phased approach to SSL VPN
planningandimplementationthatcanhelpinachievingsuccessfulSSLVPN
deployments.Italsoincludesacomparisonwithothersimilartechnologies
suchasInternetProtocolSecurity(IPSec)VPNsandotherVPNsolutions.
Storage Encryption for End User Devices
SP800-111,GuidetoStorageEncryptionTechnologiesforEndUserDevices,
assists organizations in understanding storage encryption technologies
for end user devices,such as laptops,PDAs,smart phones,and removable
media,andinplanning,implementing,andmaintainingstorageencryption
solutions. Thepublicationprovidespractical, real-worldrecommendationsfor
threeclassesofstorageencryptiontechniques:fulldiskencryption,volume
andvirtualdiskencryption,andle/folderencryption.Italsodiscussesimpor-
tantsecurityelementsofastorageencryptiondeployment,includingcrypto-
graphickeymanagementandauthentication.SP800-111waspublishedas
nalinNovember2007.
National Checklist Program
SP800-70Revision1,NationalChecklistProgramforITProductsGuide-
linesforChecklistUsersandDevelopers,wasreleasedforpubliccomment
inSeptember2008. Itdescribessecuritycongurationchecklistsandtheir
benets, and it explains how to use the NIST National Checklist Program
(NCP) to nd and retrieve checklists. It also describes the policies,proce-
dures, and general requirements for participation in the NCP. SP 800-70
Revision1updatestheoriginalpublication,whichwasreleasedin2005.
Windows XP Professional Security
SP800-68Revision1,GuidetoSecuringMicrosoftWindowsXPSystemsfor
IT Professionals: A NIST Security Conguration Checklist,was released for
publiccommentinJuly2008. ItassistsITprofessionalsinsecuringWindows
XP Professional systems running Service Pack 2 or 3. The guide provides
detailedinformationaboutthesecurityfeaturesofWindowsXPandsecurity
congurationguidelines. SP800-68Revision1updatestheoriginalpublica-
tion,whichwasreleasedin2005.
Computer Security Incident Handling Guide
SP 800-61 Revision 1, Computer Security Incident Handling Guide, helps
organizations in mitigating the risks from computer security incidents by
providing practical guidelines on responding to incidents effectively and
efciently. PublishedasnalinMarch2008,itincludesguidelinesonestab-
50
lishinganeffectiveincidentresponseprogram,buttheprimaryfocusofthe
document is detecting, analyzing, prioritizing, and handling incidents. SP
800-61 Revision 1 updates the original publication,which was released in
2004.
Security for Legacy Wireless Local Area Networks
SP 800-48 Revision 1, Guide to Securing Legacy IEEE 802.11 Wireless
Networks, was published as nal in July 2008. The publication provides
advicetoorganizationsinsecuringtheirlegacywirelesslocalareanetworks
(WLANs) that are based on early versions of the Institute of Electrical and
Electronics Engineers (IEEE) 802.11 standard.The publication assists orga-
nizations in reducing the risks associated with legacyWLANs by selecting
appropriate compensating controls. SP 800-48 Revision 1 updates the
original version of SP 800-48, which was released in November 2002. SP
800-48 Revision 1 complements, and does not replace, SP 800-97, Estab-
lishingWirelessRobustSecurityNetworks: AGuidetoIEEE802.11i. People
seekinginformationonIEEE802.11ishouldconsultSP800-97.
Firewalls and Firewall Policy
SP800-41Revision1,GuidelinesonFirewallsandFirewallPolicy,helpsorga-
nizations understand the capabilities of rewall technologies and rewall
policies. It provides practical recommendations for developing rewall
policies and for selecting, conguring, testing, deploying, and managing
rewalls. Italsodiscussesfactorstoconsiderwhenselectingrewallsolu-
tions. Thispublication,whichwasreleasedforpubliccommentinJuly2008,
replacestheoriginalversionofSP800-41,whichwasreleasedin2002.
Active Content and Mobile Code
SP 800-28Version 2,Guidelines onActive Content and Mobile Code,was
publishedasnalinMarch2008. Itprovidesanoverviewofactivecontent
and mobile code technologies in use today and offers insights for making
informedinformationtechnology(IT)securitydecisionsontheirapplication
and treatment. SP 800-28Version 2 gives details about the threats,tech-
nologyrisks,andsafeguardsforendusersystemsrelatedtoactivecontent
andmobilecode. ThispublicationreplacestheoriginalversionofSP800-28,
whichwasreleasedin2001.
Security Content Automation Protocol (SCAP) Test
Requirements
NIST Interagency Report (NISTIR) 7511, Security Content Automation
Protocol(SCAP)ValidationProgramTestRequirementsVersion1.1,describes
therequirementsthatmustbemetbyproductstoachieveSCAPvalidation.
Validation is awarded by independent laboratories that have been accred-
itedforSCAPtesting. Thisreport,whichwasreleasedforpubliccomment
in August 2008, was written primarily for accredited laboratories and for
vendorsinterestedinreceivingSCAPvalidationfortheirproducts.
Common Conguration Scoring System (CCSS)
NISTIR 7502, The Common Conguration Scoring System (CCSS), was
released for public comment in May 2008. CCSS is an open specication
formeasuringandcommunicatingthecharacteristicsandrelativeseverityof
softwaresecuritycongurationissues.Thispublicationdenesanddescribes
theCCSSstandard,providesadviceonperformingscoring,anddemonstrates
the use of CCSS through a set of examples. Once the CCSS specication
hasbeennalized,CCSSdataisexpectedtoassistorganizationsinmaking
sounddecisionsonhowcongurationissuesshouldbeaddressed,andhow
thedatacouldbeusedaspartofquantitativeassessmentsofhostsecurity.
Extensible Conguration Checklist Description Format (XCCDF)
NISTIR 7275 Revision 3, Specication for the Extensible Conguration
ChecklistDescriptionFormat(XCCDF)Version1.1.4,waspublishedasnal
inFebruary2008. ThepublicationdescribesXCCDF,whichisastandardized
XMLformatthatcanbeusedtoholdstructuredcollectionsofsecuritycong-
urationrulesforasetoftargetsystems.TheXCCDFspecicationisdesigned
to provide automated testing and scoring that can support FISMA compli-
anceandotherefforts.NISTIR7275speciesthedatamodelandExtensible
Markup Language (XML) representation for version 1.1.4 of XCCDF; the
previousrevisionofNISTIR7275addressedversion1.1.3ofXCCDF.
Contact:Ms.KarenScarfone
(301)975-8136
karen.scarfone@nist.gov
51

HONORS AND AWARDS

2 0 0 8 A N N U A L R E P O R T
Department of Commerce Gold Medal Award Department of Commerce Gold Medal Award
Thegroupisrecognizedfortheirachievementindevelopingstandardsand
guidelines that enable a new generation of voting equipment to be more
usable,accessible,reliableandsecure. Thenewstandardsareacomprehen-
sivesetofrigorous,scienticallybasedrequirementsthatbalancecompeting
interests. The standards provide the ability to test voting equipment to
ensure their integrity. These standards have been adopted by at least 39
states,eachofwhichisusingthemtotransformthewayelectionsoccurin
areassuchasusability,security,andaccessibility.
Stephenisrecognizedforthedevelopmentofatesttoolwhichhasbeenused
byindustrytoacceleratethedevelopmentofaPublicSafetyinteroperability
interface,theProject25Inter-RfSubSystemInterface. Thetoolisbeingused
byindustrytoverifywhetherornotcommunicationinterfacesbetweenrst
responderradiosystemsareworking. Componentswithinthetesttoolhave
alsobeenleveragedincommercialproductdevelopmentswithinthepublic
safetycommunicationsindustry.
Pictured Left to Right: William Burr, (CSD); Sharon Laskowski, (Information
Access Division, ITL); John Wack (Software & Systems Division, ITL); Nelson
Hastings, (CSD); Mark Skall, (Software & Systems Division, ITL); Barbara Guttman,
(Software & Systems Division, ITL); John Kelsey, (CSD); Alan Goldne (Software &
Systems Division, ITL); and Dave Flater, (Software & Systems Division, ITL).
Department of Commerce Bronze Medal Award
Dr.Cooper is recognized for signi-
cant achievements in public key
infrastructure (PKI) standardization,
testing and evaluation methodolo-
gies, and deployment to address a
fundamentalsecurityproblem-secure
distributionofcryptographickeys
within the federal government and
in the global Internet community.
David Cooper
His technical contributions include
criticalstandards,widelyusedtestingspecications,andtechnicalanalysis
thathaveenhancedtheinteroperabilityandsecurityofPKIproductsaswell
asthesecurityofthefederalPKI. Hiscontributionshavehelpedtocreate
asecureandrobustfoundationforthedeploymentofthePersonalIdentity
Verication(PIV)cardandsatisfytherequirementsimposedonNIST.
Left to Right: Stephen Quirolgico, (CSD); Mudumbai Ranganathan, (Advanced
Network Technologies Division, ITL)
FED 100 Award
StephenQuinn,acomputerscientist
in the Computer Security Division,
received the 2008 Federal 100
AwardfromFederalComputerWeek.
Quinn was honored for his work as
co-originatoroftheSecurityContent
AutomationProtocol(SCAP),atech-
nical framework that supports the
automationofsecurityoperationsin Stephen Quinn
informationsystems.
52
2 0 0 8 A N N U A L R E P O R T

COMPUTER SECURITY DIVISION

PUBLICATIONS FY2008
Key to Publications:
FIPS=FederalInformationProcessingStandards
SP=SpecialPublication
NISTIR=NISTInteragencyReport
ITL/CSD=InformationTechnologyLaboratory/ComputerSecurityDivisionSecurityBulletins
Draft Publications
Number Title Date
SP800-73-2 InterfacesforPersonalIdentityVerication October2007
SP800-39 ManagingRiskfromInformationSystems:AnOrganizationalPerspective October2007
SP800-60,Rev.1Vol.1&2 GuideforMappingTypesofInformationandInformationSystemstoSecurityCategoriesandAppendices November2007
SP800-115 TechnicalGuidetoInformationSecurityTesting November2007
SP800-53Rev.2 RecommendedSecurityControlsforFederalInformationSystems November2007
SP800-53A(naldraft) GuideforAssessingtheSecurityControlsinFederalInformationSystems December2007
SP800-79-1 GuidelinesfortheCerticationandAccreditationofPIVCardIssuingOrganizations February2008
SP800-63Rev.1 E-AuthenticationGuideline February2008
SP800-73-2(2nddraft) InterfacesforPersonalIdentityVerication March2008
SP800-64Rev.2 SecurityConsiderationsintheSystemDevelopmentLifeCycle March2008
SP800-116 ARecommendationfortheUseofPIVCredentialsinPhysicalAccessControlSystems April2008
SP800-39(2nddraft) ManagingRiskfromInformationSystems:AnOrganizationalPerspective April2008
SP800-108 RecommendationforKeyDerivationUsingPseudorandomFunctions May2008
SP800-66Rev.1 AnIntroductoryResourceGuidetoImplementingtheHealthInsurancePortabilityandAccountabilityAct
(HIPAA)SecurityRule
May2008
SP800-123 GuidetoGeneralServerSecurity May2008
NISTIR7502 TheCommonCongurationScoringSystem(CCSS) May2008
SP800-124 GuidelinesonCellPhoneandPDASecurity July2008
SP800-121 GuidetoBluetoothSecurity July2008
SP800-107(2nddraft) RecommendationforApplicationsUsingApprovedHashAlgorithms July2008
SP800-41Rev.1 GuidelinesonFirewallsandFirewallPolicy July2008
SP800-68Rev.1 GuidetoSecuringMicrosoftWindowsXPSystemsforITProfessionals July2008
SP800-106 RandomizedHashingforDigitalSignatures August2008
NISTIR7511Ver.1.1 SecurityContentAutomationProtocol(SCAP)ValidationProgramTestRequirements August2008
SP800-37Rev.1 GuideforSecurityAuthorizationofFederalInformationSystems:ASecurityLifecycleApproach August2008
SP800-116(2nddraft) ARecommendationfortheUseofPIVCredentialsinPhysicalAccessControlSystems September2008
SP800-70Rev.1 NationalChecklistProgramforITProducts--GuidelinesforChecklistUsersandDevelopers September2008
SP800-82(naldraft) GuidetoIndustrialControlSystems(ICS)Security September2008
53
2 0 0 8 A N N U A L R E P O R T
Federal Information Processing Standards (FIPS)
Date Title Date
FIPS198-1 TheKeyed-HashMessageAuthenticationCode(HMAC) July2008
NIST Special Publications
Number Title Date
SP800-114 User'sGuidetoSecuringExternalDevicesforTeleworkandRemoteAccess November2007
SP800-111 GuidetoStorageEncryptionTechnologiesforEndUserDevices November2007
SP800-38D RecommendationforBlockCipherModesofOperation:Galois/CounterMode(GCM)andGMAC November2007
SP800-53Rev.2 RecommendedSecurityControlsforFederalInformationSystems December2007
SP800-28Ver.2 GuidelinesonActiveContentandMobileCode March2008
SP800-61Rev.1 ComputerSecurityIncidentHandlingGuide March2008
SP800-87Rev.1 CodesfortheIdenticationofFederalandFederally-AssistedOrganizations April2008
SP800-53A GuideforAssessingtheSecurityControlsinFederalInformationSystems June2008
SP800-67Rev.1.1 RecommendationfortheTripleDataEncryptionAlgorithm(TDEA)BlockCipher June2008
SP800-79-1 GuidelinesfortheAccreditationofPersonalIdentityVericationCardIssuers June2008
SP800-113 GuidetoSSLVPNs July2008
SP800-55Rev.1 PerformanceMeasurementGuideforInformationSecurity July2008
SP800-48Rev.1 GuidetoSecuringLegacyIEEE802.11WirelessNetworks July2008
SP800-123 GuidetoGeneralServerSecurity July2008
SP800-60,Rev.1Vol.1&2 GuideforMappingTypesofInformationandInformationSystemstoSecurityCategoriesandAppendices August2008
SP800-73-2 InterfacesforPersonalIdentityVerication September2008
SP800-121 GuidetoBluetoothSecurity September2008
SP800-115 TechnicalGuidetoInformationSecurityTestingandAssessment September2008
NIST Interagency Reports
Number Title Date
IR7442 ComputerSecurityDivision-2007AnnualReport April2008
IR7516 ForensicFilteringofCellPhoneProtocols August2008
ITL-CSD Security Bulletins
Number Title
October2007 TheCommonVulnerabilityScoringSystem(CVSS)
November2007 UsingStorageEncryptionTechnologiestoProtectEndUserDevices
December2007 SecuringExternalComputersAndOtherDevicesUsedbyTeleworkers
January2008 SecureWebServersProtectingWebSitesThatAreAccessedByThePublic
February2008 FederalDesktopCoreConguration(FDCC):ImprovingSecurityForWindowsDesktopOperatingSystems
March2008 HandlingComputerSecurityIncidents:NISTIssuesUpdatedGuidelines
April2008 UsingActiveContentAndMobileCodeAndSafeguardingTheSecurityOfInformationTechnologySystems
May2008 NewCryptographicHashAlgorithmFamily:NISTHoldsAPublicCompetitionToFindNewAlgorithms
July2008 GuidelinesOnImplementingASecureSocketsLayer(SSL)VirtualPrivateNetwork(VPN)
August2008 SecurityAssessments:ToolsForMeasuringTheEffectivenessOfSecurityControls
September2008 UsingPerformanceMeasurementsToEvaluateAndStrengthenInformationSystemSecurity
54
2 0 0 8 A N N U A L R E P O R T

WAYS TO ENGAGE OUR
DIVISION AND NIST
Guest Research Internships at NIST Funding Opportunities at NIST
O
pportunitiesareavailableatNISTfor6-to24-monthinternshipswithin
CSD. QualiedindividualsshouldcontactCSD,provideastatementof
qualications,and indicate the area of work that is of interest. Generally
speaking,thesalarycostsarebornebythesponsoringinstitution;however,
in some cases, these guest research internships carry a small monthly
stipendpaidbyNIST. Forfurtherinformation,contactMr.CurtBarker,(301)
975-8443,william.barker@nist.govorMs.DonnaDodson,(301)975-3669,
donna.dodson@nist.gov.
Details at NIST for Government or Military Personnel
O
pportunitiesareavailableatNISTfor6-to24-monthdetailsatNISTin
CSD. QualiedindividualsshouldcontactCSD,provideastatementof
qualications,and indicate the area of work that is of interest. Generally
speaking,thesalarycostsarebornebythesponsoringagency;however,in
some cases, agency salary costs may be reimbursed by NIST. For further
information,contact Mr.Curt Barker,(301) 975-8443,william.barker@nist.
govorMs.DonnaDodson,(301)975-3669,donna.dodson@nist.gov.
Federal Computer Security Program Managers Forum
T
he FCSPM Forum is covered in detail in the Outreach section of this
report. Membershipisfreeandopentofederalemployees. Forfurther
information, contact Ms. Marianne Swanson, (301) 975-3293, marianne.
swanson@nist.gov.
Security Research
N
IST occasionally undertakes security work, primarily in the area of
research,fundedbyotheragencies. Suchsponsoredworkisaccepted
byNISTwhenitcancost-effectivelyfurtherthegoalsofNISTandthespon-
soring institution. For further information, contact Mr.Tim Grance, (301)
975-3359,tim.grance@nist.gov.
N
IST funds industrial and academic research in a variety of ways. Our
Technology Innovation Program provides cost-shared awards to
industry,universities,andconsortiaforresearchonpotentiallyrevolutionary
technologiesthataddresscriticalnationalandsocietalneedsinNISTsareas
oftechnicalcompetence. TheSmallBusinessInnovationResearchProgram
fundsR&Dproposalsfromsmallbusinesses. Wealsoofferothergrantsto
encourageworkinspecicelds:precisionmeasurement,reresearch,and
materialsscience. Grants/awardssupportingresearchatindustry,academia,
andotherinstitutionsareavailableonacompetitivebasisthroughseveral
differentInstituteofces.ForgeneralinformationonNISTgrantsprograms,
contactMs.MelindaChukran,(301)975-5266,melinda.chukran@nist.gov.
Summer Undergraduate Research Fellowship (SURF)
C
urious about physics, electronics, manufacturing, chemistry, materials
science, or structural engineering? Intrigued by nanotechnology, re
research,information technology,or robotics?Tickled by biotechnology or
biometrics?Haveanintellectualfancyforsuperconductorsorperhapssemi-
conductors?
Heresyourchancetosatisfythatcuriosity,byspendingpartofyoursummer
workingelbow-to-elbowwithresearchersatNIST,oneoftheworldsleading
researchorganizationsandhometothreeNobelPrizewinners.Gainvaluable
hands-on experience,work with cutting-edge technology,meet peers from
across the nation (from San Francisco to Puerto Rico, New York to New
Mexico),andsampletheWashington,D.C.,area.Andgetpaidwhileyou're
learning. For further information, see http://www.surf.nist.gov or contact
NIST SURF Program,100 Bureau Dr.,Stop 8400,Gaithersburg,MD 20899-
8499,(301)975-4200,NIST_SURF_program@nist.gov
55
S E C T I O N H E A D E R

2 0 0 8 A N N U A L R E P O R T
Acknowledgements
Theeditor,PatrickOReillyoftheNationalInstituteofStandardsandTechnology(NIST),wishestothankhiscolleaguesintheComputer
SecurityDivision,whoprovidedwrite-upsontheir2008projecthighlightsforthisdocument.Theeditorwouldalsoliketoacknowledge
KevinStine(NIST)forhissupportandhelpwiththisannualreport. TheeditorwouldalsoliketoacknowledgeTanyaBrewer(NIST)forher
guidancewiththisannualreport. TheeditorwouldalsoliketoacknowledgeKarenScarfone(NIST),ShirleyRadack(NIST)andNipaShah
(StateDepartment)forreviewingandprovidingfeedbackforthisannualreport.
56
2 0 0 8 A N N U A L R E P O R T S E C T I O N H E A D E R
U.S. Department of Commerce
OttoJ.Wolff,Acting Secretary
National Institute of Standards and Technology
PatrickGallagher,Deputy Director
NISTIR7536
ComputerSecurityDivision2008AnnualReport
PatrickOReilly,Editor
Computer Security Division
InformationTechnologyLaboratory
NationalInstituteofStandardsandTechnology
MichaelJames,Art Director
TheDesignPond
Disclaimer: Anymentionofcommercialproductsisfor
informationonly;itdoesnotimplyNISTrecommendationor
endorsement,nordoesitimplythattheproductsmentioned
arenecessarilythebestavailableforthepurpose.

Nistir 7536 2008 CSD Annual Report

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Nistir 7536 2008 CSD Annual Report

Încărcat de

Drepturi de autor:

Formate disponibile

Computer Security Division

2008 Annual Report

HONORS AND AWARDS

COMPUTER SECURITY DIVISION

S-ar putea să vă placă și