Webinars

NIST Cybersecurity for IoT Draft Guidance: Rounding Up the Requirements

Tuesday, January 26, 2021

IoT devices are becoming integral elements of federal information systems, which is why NIST has released for public review draft guidance on defining federal IoT cybersecurity requirements, including supporting non-technical requirements. These four new documents expand the range of guidance for IoT cybersecurity, with the goal of ensuring IoT devices are integrated into the security and privacy controls of federal information systems.

The new documents are:

In this upcoming webinar, the NIST authors will present key ideas from the documents and take questions. Join us for an informative session as the NIST Cybersecurity for IoT program seeks to continue to the conversation.

NIST looks forward to the community’s feedback on these drafts as we work to provide IoT cybersecurity guidance that aids both the vendor community and the customer community in taking advantage of the benefits that IoT devices can bring while thoughtfully and effectively responding to the associated risks.

Event Details

Date: Tuesday, January 26, 2021

Time: 1:00 pm - 3:00 pm

Location: A WebEx link will be provided upon registration.

 

For additional questions, please contact iotsecurity@nist.gov.

CSG Virtual Policy Academy — Privacy and Cybersecurity

Monday, December 7, 2020

NCCoE/PEP’s Nakia Grayson will speak at the Council of State Governments (CSG) Virtual Policy Academy on Monday, December 7, 2020, from 2:45pm-3:45pm (Eastern). Nakia is part of a panel discussion, COVID-19 & Health Care Impacts, discussing how privacy risks can be addressed in telehealth. She will speak about the privacy challenges and work related in the NCCoE’s Securing Telehealth: Remote Patient Monitoring Ecosystem.

Virtual Workshop on the Automation of the NIST Cryptographic Module Validation Program (CMVP)

Monday, October 5, 2020

Workshop Overview

The National Institute of Standards and Technology (NIST) hosted a virtual workshop on the Automation of the NIST Cryptographic Module Validation Program (CMVP) on Monday, October 5, 2020. The number of cryptographic module validations has outstripped the available human resources for timely validation processing. This phenomenon is affecting all stakeholders participating in the CMVP (vendors, labs, and validators alike). The purpose of the workshop discussed the challenges and proposed approaches associated with automating the CMVP. The approach to CMVP automation must be based on consistent and reproducible evidence generated and reported by the producers of technologies that implement cryptographic capabilities. The findings from this workshop will inform the development of a potential National Cybersecurity Center of Excellence (NCCoE) demonstration project that supports the Federal Information Processing Standards (FIPS) 140-3 Cryptographic Module Validation Program. The automated program should show a capability to process and deliver results at machine speed.

Workshop Recording

Post-Workshop Materials

Slide presentations are linked to the speaker. 

 Presentation #1

 NIST and NCCoE Overview

 Jeff Greene

 Presentation #2

 Workshop Overview & Background

 Matt Scholl

 Presentation #3

 Status of the Automation of NIST Cryptographic Validation   Programs

 Apostol Vassilev

 

 Presentation #4

 Presentation #5

 Presentation #6

 Presentation #7

 Challenges Session

  • Integration challenges of the new validation program with the existing automated algorithm validation program 
    • Barry Fussell, Cisco
  • Schema and protocols for evidence submission for module validation
    • Miguel Osorio, Google
  • Requirements for establishing a new automated module validation scope in NIST Handbook 150-17
    • Tim Anderson, Amazon
  • Challenges to your organization
    • Blair Heiserman, NIST

 

 

 

 

Presentation #8

 Presentation #9

 Presentation #10

 Presentation #11

 Presentation #12

 Presentation #13

 

 Ten Minute Participant Lightning Talk Session

  • Mike Grimm, Microsoft
  • Mike Dodds, Galois
  • Chris Celi, NIST
  • Gavin O'Brien, NIST
  • Stephan Mueller, ATSEC
  • Ravi Jagannathan, VMWare

 

 

 Presentation #14

 Next Steps/Wrap-up (NCCoE)

 Curt Barker

 


Background

The NCCoE is developing a NIST CMVP automation project that includes practice descriptions in the form of white papers, playbook generation, and implementation demonstrations. The project aims to improve the ability and efficiency of organizations. The project will examine automated testing within the scope of NIST Handbook 150-17, NVLAP Cryptographic and Security Testing as an alternative to the existing CMVP program. (NVLAP stands for National Voluntary Laboratory Accreditation Program.) The approach is similar to that of the successful development and rollout of the Automated Cryptographic Algorithm Validation scope in Annex G of NIST Handbook 150-17, and the establishment of an alternative active scope of validation testing under the NIST Cryptographic Algorithm Validation Program (CAVP).

This proposed project generally requires:

  • developing data schema that would enable the generation and validation of standardized evidence produced by the operational testing of an Implementation Under Test (IUT) executing on a Device Under Test (DUT)
  • developing protocols for submitting evidence and receiving comments and results based on that evidence
  • developing capabilities that associate the Automated Cryptographic Module Validation Protocol (AMVP) evidence with other evidence, such as the cryptographic algorithm validation data produced using the Automated Cryptography Validation Protocol (ACVP), that would enable the complete and verifiable representation of an IUT
  • leveraging the ACVP to the greatest extent possible to maintain a consistent system architecture
  • developing implementation validation tools and services to enable an end-to-end validation scope for the CMVP
  • updating the processes and procedures used by developers, implementers, validators, and consumers of validated implementations

The outcome of the project will support the modernization of the CMVP. The resulting program will likely be offered as an alternative to the existing program to be used in parallel for a period of time needed to allow the automated program to mature and become fully viable for all stakeholders.

Once the automated program is established, other approaches to accelerating its adoption across the stakeholder organizations could include:

  • developing a risk-based approach that takes security requirements, business operations, and mission impact into consideration
  • establishing a communication plan to be used within the organization and for external customers and partners
  • identifying a migration timeline and the necessary resources
  • updating or replacing current security standards, procedures, and recommended practice documentation
  • providing installation, configuration, and administration documentation
  • testing and validating the new processes and procedures

Please join the community-of-interest by sending an email to applied-crypto-testing@nist.gov to get the latest updates on the activities related to the Automation of the NIST Cryptographic Module Validation Program (CMVP).

 

Questions? 

Please send an email to applied-crypto-testing@nist.gov

 

Virtual Workshop on Challenges with Compliance, Operations, and Security with TLS 1.3

Friday, September 25, 2020

Workshop Overview

The National Institute of Standards and Technology (NIST) hosted a virtual workshop discussed compliance, operations, and security challenges with modern encrypted protocols on Friday, September 25, 2020. Deployment of these protocols, in particular TLS 1.3, can impact some organizations ability to meet their regulatory, security, and operational requirements. The workshop investigated the practical and implementable approaches to help those industries adopt them in their private data centers and the hybrid cloud without impacting regulatory compliance, security, or operations. 

The workshop identified various approaches and practices that met  common compliance, operations, and security requirements. The findings from this workshop will inform the development of a potential National Cybersecurity Center of Excellence (NCCoE) demonstration project to implement one or more of the proposed approaches while meeting the business use cases, the security capabilities, and supporting technologies. 

Workshop Recording

Post-Workshop Materials

Slide presentations are linked to each speaker. 

 Presentation #1

 NIST and NCCoE Overview

 Jeff Greene

 Presentation #2

 Workshop Overview & Background

 Tim Polk

 Presentation #3

 IETF Principles for Encrypted Protocols

 Sean Turner

 

 Presentation #4

 Compliance Challenges

 Ralph Poore

 Presentation #5

 Operations Challenges

 Steve Fenter

 Presentation #6

 Security Challenges

 John Banghart

 Presentation #7

 Instructive Scenarios for Demonstration Projects

 Paul Turner

 

 

 

 Presentation #8

 Presentation #9

 Presentation #10

 Proposed Approaches

  • Paul Barret
  • Steve Perkins
  • Nancy Cam-Winget

 

 

 Presentation #11

 Next Steps/Wrap-up

 Curt Barker


Background

The workshop will focus on enterprise data center environments which include on-premise data center and hybrid cloud deployment hosted by a third-party data center or a public cloud provider. The public Internet is out of scope. When enterprises deploy network security protocols within the data center to provide integrity and confidentiality, the amount of encrypted data in the enterprise data center increases, and visibility decreases. Enterprises have traditionally depended upon visibility into data in transit within their networks to implement critical cybersecurity and operational controls (e.g., intrusion detection, malware detection, fraud monitoring, and troubleshooting). These cybersecurity controls support both enterprise security and regulatory requirements. For example, some industries are required to monitor transactions for fraud, a task made more difficult if network traffic cannot be decrypted. In particular, enterprise architectures facilitate comprehensive inspection, collection, and analysis of data (i.e., both enterprise and personal data) through a small number of passive or active monitoring devices. To maintain visibility, these cybersecurity controls are provided with cryptographic keying material needed to decrypt the traffic. However, in many widely deployed protocols, this deviates from the original trust model because the keys needed to decrypt traffic are also used to authenticate the server, making the control devices indistinguishable from the authentic server.

Recent enhancements to these security protocols have made visibility in the enterprise data center more challenging—TLS 1.3 and QUIC are examples. While these protocol enhancements increase performance and address security concerns on the public internet, they also reduce visibility. In addition, emerging deployment models leverage encrypted transport to protect protocols that were previously in the clear (e.g., DoT (DNS over TLS) and DoH (DNS over HTTPS)). DoT and DoH are out of scope for the current project, but may be the subject of future NCCoE work. Enhanced security protocols and deployment models were not designed to accommodate decryption of traffic flows by passive monitoring devices, creating potential compliance, security and operational impacts in enterprises.

Consequently, enterprises have raised questions about how to implement critical services, meet enterprise security, operational, and regulatory requirements, use the enhanced security protocols, and leverage new deployment models all at the same time. Such enterprises may need to consider applying new architectures and novel techniques to augment or replace traditional monitoring devices while satisfying their business, regulatory, and network operations requirements.

NIST invites industry subject matter experts and practitioners to present their views related to challenges to compliance, operations, and security with the modern encrypted protocols, in particular TLS 1.3, as well as proposed solutions. The workshop provides an opportunity for participants to provide feedback on all aspects of the planned activities to include: challenges, impacted protocols, relevant standards, guidelines, recommended practices, use cases and technologies to be considered, and sources of specifications and guidance. NIST will use the resulting prioritized list of activities to develop an NCCoE project to help accelerate the investigation and demonstration of proposed approaches along with their supporting technologies that can be deployed and operated securely by default.

Please join the community of interest by sending an email to applied-crypto-visibility@nist.gov to get the latest updates on the activities related to Challenges with Compliance, Operations, and Security with Encrypted Protocols.

 

Additional Resources

In Fall 2019, NIST participated in an invitational workshop on Enterprise visibility hosted by the Center for Cybersecurity Policy and Law at Venable. The workshop report is available here (https://centerforcybersecuritypolicy.org/enterprise-data-center-transparency-and-security-initiative).

 
Questions? 

Please send an email to applied-crypto-visibility@nist.gov .

 

Virtual Workshop on Considerations in Migrating to Post-Quantum Cryptographic Algorithms

Wednesday, October 7, 2020

Workshop Overview

The National Institute of Standards and Technology (NIST) hosted a virtual workshop on Wednesday, October 7, 2020. The purpose of the workshop was to discuss the challenges and investigate the practical and implementable approaches to ease the migration from the current set of public key cryptographic algorithms to replacement algorithms that are resistant to quantum computer based attacks. This effort complements the NIST post-quantum cryptography (PQC) standardization activities (https://csrc.nist.gov/projects/post-quantum-cryptography).

Workshop Recording 

Post-Workshop Materials

Slide presentations are linked to the speaker.

 NIST and NCCoE Overview
 Jeff Greene
 Workshop Overview & Background
 Curt Barker
 Status of NIST PQC Activity
 Dustin Moody 
 
 
 Presentation #4
 
 Presentation #5
 
 
 

Challenges Session

  • ETSI Cyber QSC WG, Migration to PQC
    • Colin Whorlow, NCSC
  • Integration Challenges
    • Christian Paquin, Microsoft
  • Customer Challenges
    • Yassir Nawaz, J.P. Morgan Chase
  • Challenge Overview 
    • Mike Boyle, NSA
 
 
 
Presentation #8
 Presentation #9
 
 Presentation #13
 
 
 Presentation #15
 
 Presentation #16
 
 
 Presentation #17
 
 
 Presentation #19
 Presentation #20
 
 Presentation #21
 

 Five Minute Participant Lightning Talk Session

  • David Forscey, Aspen Institute
  • David Ott, VMware
  • Russ Housley, IETF experimental protocols
  • Vladimir Soukharev, Infosec Global
  • Douglas Stebila, Unviersity of Waterloo 
  • Oussama Danba, PQshield

 

 Presentation #22

 Next Steps/Wrap-up (NCCoE)

 Curt Barker


Background

The National Cybersecurity Center of Excellence (NCCoE) is initiating the development of practices in the form of white papers, playbooks, and demonstrable implementations for organizations to ease the migration from the current set of public key cryptographic algorithms to replacement algorithms that are resistant to quantum computer based attacks. From time to time, the discovery of a cryptographic weakness or advances in the technologies leads to the need to replace a legacy cryptographic algorithm. The advent of quantum computing technology will compromise many of the current cryptographic algorithms in particular public-key cryptography used widely to protect digital information. Algorithm replacement can be extremely disruptive and often takes decades to accomplish. The replacement of algorithms generally requires:

  • identifying the presence of the legacy algorithms,
  • understanding the data formats and application programing interfaces of cryptographic libraries to support necessary changes and replacements,
  • developing implementation validation tools,
  • discovering the hardware that implements or accelerates algorithm performance,
  • determining operating system and applications code that use the algorithm,
  • identifying all communications protocols with quantum-vulnerable crypto algorithms, and
  • updating the processes and procedures of developers, implementers, and users.

The new algorithms will likely not be drop-in replacement and they may not have the same performance or reliability characteristics as the legacy algorithms due to the differences in characteristics such as key size, signature size, error handling properties, number of execution steps required to perform the algorithm, and key establishment process complexity.

Once the replacement algorithms are selected, other operational considerations to accelerate the adoption and implementation across the organization include:

  • developing a risk-based approach, taking into consideration security requirements, business operations, and mission impact;
  • establishing a communication plan to be used within the organization and for external customers and partners;
  • identifying a migration timeline and the necessary resources;
  • updating or replacing security standards, procedures, and recommended practice documentation;
  • providing installation, configuration, and administration documentation, and
  • testing and validating the new processes and procedures.

See the NIST Cybersecurity White Paper Getting Ready for Post-Quantum Cryptography: Explore Challenges Associated with Adoption and Use of Post-Quantum Cryptographic Algorithms for additional background.

The NCCoE will publish a summary of these contributions (without attribution) before the workshop to maximize the exchange of ideas. 

Please join the community of interest by sending an email to applied-crypto-pqc@nist.gov to get the latest updates on the activities related to Migrating to Post-Quantum Cryptographic Algorithms.

Questions? 

Please send an email to applied-crypto-pqc@nist.gov

 

De-mystifying Secure Software Development Webinar

Tuesday, June 23, 2020

Background

Once seen as only tangential to cybersecurity planning, software security has recently emerged as a top priority for policymakers, businesses, and users around the world. As our collective understanding of cybersecurity has grown, we have come to recognize the central role secure design and development plays in protecting the software that powers our world. Unfortunately, software security discussions have long been hampered by inconsistent terminology, lack of clarity around best practices, and a sense that only the most technically inclined could ever really make sense of the process. A new software development framework from NIST is poised to change all that.

Much like it did with its Cybersecurity Framework, NIST has brought together what we have learned about software security over the past two decades and created a secure software development framework (SSDF) that can get us all talking from the same playbook. The framework builds on SAFECode’s publications on secure development best practices, the BSA Framework for Secure Software, and other industry contributions to deliver a core set of high-level secure software development practices that help ensure that software is secure by design. Software producers who follow these practices can reduce the number of vulnerabilities in released software, mitigate the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to achieve continuous improvement of software security. Software consumers can use the framework to confidently build their security requirements and apply them as applicable to their software acquisition processes.

Event Details

Please register here to join BSA and SAFECode along with government and industry panelists in a virtual roundtable discussion on Tuesday, June 23 from 11 a.m. to 1 p.m. to learn about the SSDF and hear about its practical applications for product developers, public and private sector customers, and the future of product certifications and labeling.

Questions about this session should be directed to BSA’s Tommy Ross (thomasr@bsa.org) or SAFECode’s Steve Lipner (lipner@safecode.org). 

Agenda

Slides from this session can be found here
 
11:00 - 11:05 a.m.
Welcome remarks
Kevin Stine, NIST
 
11:05 - 11:20 a.m.
Introduction and overview of the NIST Secure Software Development Framework
Karen Scarfone, NIST Associate
 
11:20 - 11:30 a.m.
BSA’s perspective
Tommy Ross, BSA
 
11:30 - 11:40 a.m.
SAFECode’s perspective
Steve Lipner, SAFECode
  
11:40 - 11:55 a.m.
Q&As
BSA/NIST/SAFECode
Tommy Ross, Karen Scarfone, Kevin Stine, and Steve Lipner
 
12:05 - 12:45 p.m.
Perspectives on Applying the SSDF
  • Guiding Product Development:  Valecia Maclin, Microsoft
  • Supporting private sector software acquisition:  John Banghart, Venable
  • Improving government acquisition: Melinda Reed, DoD
  • Shaping interoperability, synergies, and evaluation: Prokopios Drogkaris and Apostolos Malatras, ENISA
 
12:45 - 12:55 p.m.
Q&As
Invited speakers
Valecia Maclin, John Banghart, Melinda Reed, Prokopios Drogkaris and Apostolos Malatras
 
12:55 - 13:00 p.m.
Closing remarks and next steps
BSA/NIST/SAFECode
Tommy Ross, Kevin Stine, and Steve Lipner

Energy Analytic Security Exchange Meeting

Tuesday, May 7, 2019

NCCoE Engineer Jim McCarthy will be speaking to Energy Analytic Security Exchange (EASE) members on their biweekly member analyst call on May 7. 

Attendees will incude EASE staff analysts and energy companies’ cyber and physical security analysts and managers and will cover how the NCCoE can be used as a resource to the community.

For more information, please visit or email membership@energy-ase.com

IoTSSA Podcast

Thursday, February 14, 2019

Join Brian (of IoTSSA) in a discussion on the NIST Cybersecurity Framework with Karen Waltermire, Cybersecurity Engineer with NIST and Harry Perper Dept Chief Engineer with The MITRE Corporation.

Under the parent organization NIST, the NCCOE (National Cybersecurity Center of Excellence) accelerates businesses’ adoption of standards-based, advanced security technologies. They consult with IT security professionals and other leaders to identify their most pressing cybersecurity issues so they may develop new and evolve current support programs for SMB’.

Making Mobile Access Secure and Convenient Using Derived PIV Credentials

Wednesday, December 12, 2018

The government workplace is already using tablets and/or smartphones to access secure data, but the existing technology available to reach this data securely can be unwieldy and somewhat outdated. In this webinar, scheduled for December 12 at 11:00 am, Intercede and the NCCoE will share how your organization can leverage derived PIV credentials to access important information securely and without it being a hassle.

Register for this webinar to learn:

  • What derived PIV credentials (DPC) are
  • How DPCs can help make access to mobile devices secure and convenient
  • What to consider in selecting a DPC solution