Webinars

An Invitational Virtual Workshop on Challenges with Compliance, Operations, and Security with Encrypted Protocols, in Particular TLS 1.3

Thursday, August 13, 2020

Workshop Objectives

The National Institute of Standards and Technology (NIST) will host an invitational virtual workshop to discuss compliance, operations, and security challenges with modern encrypted protocols on Thursday, August 13, 2020. Deployment of these protocols, in particular TLS 1.3, can impact some organizations ability to meet their regulatory, security, and operational requirements. The workshop will investigate the practical and implementable approaches to help those industries adopt them in their private data centers and the hybrid cloud without impacting regulatory compliance, security, or operations. Invitations will be extended to parties that submit brief descriptions of their interest in this topic.

The workshop will identify various approaches and practices to meet common compliance, operations, and security requirements. The findings from this workshop will inform the development of a potential National Cybersecurity Center of Excellence (NCCoE) demonstration project to implement one or more of the proposed approaches while meeting the business use cases, the security capabilities, and supporting technologies. 

Background

The workshop will focus on enterprise data center environments which include on-premise data center and hybrid cloud deployment hosted by a third-party data center or a public cloud provider. The public Internet is out of scope. When enterprises deploy network security protocols within the data center to provide integrity and confidentiality, the amount of encrypted data in the enterprise data center increases, and visibility decreases. Enterprises have traditionally depended upon visibility into data in transit within their networks to implement critical cybersecurity and operational controls (e.g., intrusion detection, malware detection, fraud monitoring, and troubleshooting). These cybersecurity controls support both enterprise security and regulatory requirements. For example, some industries are required to monitor transactions for fraud, a task made more difficult if network traffic cannot be decrypted. In particular, enterprise architectures facilitate comprehensive inspection, collection, and analysis of data (i.e., both enterprise and personal data) through a small number of passive or active monitoring devices. To maintain visibility, these cybersecurity controls are provided with cryptographic keying material needed to decrypt the traffic. However, in many widely deployed protocols, this deviates from the original trust model because the keys needed to decrypt traffic are also used to authenticate the server, making the control devices indistinguishable from the authentic server.

Recent enhancements to these security protocols have made visibility in the enterprise data center more challenging—TLS 1.3 and QUIC are examples. While these protocol enhancements increase performance and address security concerns on the public internet, they also reduce visibility. In addition, emerging deployment models leverage encrypted transport to protect protocols that were previously in the clear (e.g., DoT (DNS over TLS) and DoH (DNS over HTTPS)). DoT and DoH are out of scope for the current project, but may be the subject of future NCCoE work. Enhanced security protocols and deployment models were not designed to accommodate decryption of traffic flows by passive monitoring devices, creating potential compliance, security and operational impacts in enterprises.

Consequently, enterprises have raised questions about how to implement critical services, meet enterprise security, operational, and regulatory requirements, use the enhanced security protocols, and leverage new deployment models all at the same time. Such enterprises may need to consider applying new architectures and novel techniques to augment or replace traditional monitoring devices while satisfying their business, regulatory, and network operations requirements.

NIST invites industry subject matter experts and practitioners to present their views related to challenges to compliance, operations, and security with the modern encrypted protocols, in particular TLS 1.3, as well as proposed solutions. The workshop provides an opportunity for participants to provide feedback on all aspects of the planned activities to include: challenges, impacted protocols, relevant standards, guidelines, recommended practices, use cases and technologies to be considered, and sources of specifications and guidance. NIST will use the resulting prioritized list of activities to develop an NCCoE project to help accelerate the investigation and demonstration of proposed approaches along with their supporting technologies that can be deployed and operated securely by default.

Call for Participation 

To apply for participation in this free workshop, the NIST NCCoE is requesting submission of a brief (2 page maximum) position paper from each interested party or organization. Expectations and suggested topics for position papers are described in the following paragraphs. Position papers submitted on behalf of organizations may support the participation of up to three employees or affiliates of that organization. Applicants should be prepared to submit email addresses for all three participants along with the position paper. The NCCoE will publish a summary of these contributions (without attribution) before the workshop to maximize the exchange of ideas.

Applicants are encouraged to focus on operational, security and/or compliance challenges encountered or anticipated in (1) the deployment experience with TLS 1.3, (2) deployment models that introduce encryption for protocols associated with historically clear text services, or (3) describe the capabilities and limitations of solutions. Applicants are encouraged to address both challenges and solutions where appropriate.

Position papers that cite operational challenges should clearly identify the operational requirements, how those requirements have been achieved in the past, and the impact (experienced or anticipated) of deploying more recent protocols or service models. Similarly, position papers that cite security challenges should clearly identify enterprise security objectives, the controls your organization relies upon, and the impact (experienced or anticipated) of deploying more recent protocols or service models. Position papers that address compliance challenges should cite the compliance regime and identify problematic requirements.

Position papers must be submitted for consideration by July 14, 2020.  The workshop will be limited to 200 participants. 

The workshop will be recorded and the content will be made available after the event. Please join the community of interest by sending an email to applied-crypto-visibility@nist.gov to get the latest updates on the activities related to Challenges with Compliance, Operations, and Security with Encrypted Protocols.


Agenda

 12:00 – 12:10

 NIST and NCCoE Overview

 12:10 – 12:25

 Workshop Overview & Background

 12:25 – 12:45

 IETF Principles for Encrypted Protocols

 12:45 – 12:55

 Moderated Q&A

 12:55 – 13:00

 Break

 13:00 – 13:15

 Compliance Challenges

 13:15 – 13:30

 Operations Challenges

 13:30 – 13:45

 Security Challenges

 13:45 – 14:00

 Instructive Scenarios for Demonstration Projects

 14:00 – 14:10

 Moderated Q & A

 14:10 – 14:15

 Break

 14:15 – 15:00

 Proposed Approaches

 15:00 – 15:15

 Moderated Q & A

 15:15 – 15:30

 Next Steps/Wrap-up (NCCoE)

 

Additional Resources

A read-ahead white paper will be released before the workshop to provide additional details and context about the challenges to be discussed at the workshop.

In Fall 2019, NIST participated in an invitational workshop on Enterprise visibility hosted by the Center for Cybersecurity Policy and Law at Venable. The workshop report is available here (https://centerforcybersecuritypolicy.org/enterprise-data-center-transparency-and-security-initiative).

 
Questions? 

Please send an email to applied-crypto-pqc@nist.gov

 

An Invitational Virtual Workshop on Considerations in Migrating to Post-Quantum Cryptographic Algorithms

Monday, August 24, 2020

Workshop Objectives

The National Institute of Standards and Technology (NIST) will host a virtual workshop on August 24 2020. The purpose of the workshop is to discuss the challenges and investigate the practical and implementable approaches to ease the migration from the current set of public key cryptographic algorithms to replacement algorithms that are resistant to quantum computer based attacks. This effort complements the NIST post-quantum cryptography (PQC) standardization activities (https://csrc.nist.gov/projects/post-quantum-cryptography).

Background

The National Cybersecurity Center of Excellence (NCCoE) is initiating the development of practices in the form of white papers, playbooks, and demonstrable implementations for organizations to ease the migration from the current set of public key cryptographic algorithms to replacement algorithms that are resistant to quantum computer based attacks. From time to time, the discovery of a cryptographic weakness or advances in the technologies leads to the need to replace a legacy cryptographic algorithm. The advent of quantum computing technology will compromise many of the current cryptographic algorithms in particular public-key cryptography used widely to protect digital information. Algorithm replacement can be extremely disruptive and often takes decades to accomplish. The replacement of algorithms generally requires:

  • identifying the presence of the legacy algorithms,
  • understanding the data formats and application programing interfaces of cryptographic libraries to support necessary changes and replacements,
  • developing implementation validation tools,
  • discovering the hardware that implements or accelerates algorithm performance,
  • determining operating system and applications code that use the algorithm,
  • identifying all communications protocols with quantum-vulnerable crypto algorithms, and
  • updating the processes and procedures of developers, implementers, and users.

The new algorithms will likely not be drop-in replacement and they may not have the same performance or reliability characteristics as the legacy algorithms due to the differences in characteristics such as key size, signature size, error handling properties, number of execution steps required to perform the algorithm, and key establishment process complexity.

Once the replacement algorithms are selected, other operational considerations to accelerate the adoption and implementation across the organization include:

  • developing a risk-based approach, taking into consideration security requirements, business operations, and mission impact;
  • establishing a communication plan to be used within the organization and for external customers and partners;
  • identifying a migration timeline and the necessary resources;
  • updating or replacing security standards, procedures, and recommended practice documentation;
  • providing installation, configuration, and administration documentation, and
  • testing and validating the new processes and procedures.

See the NIST Cybersecurity White Paper Getting Ready for Post-Quantum Cryptography: Explore Challenges Associated with Adoption and Use of Post-Quantum Cryptographic Algorithms for additional background.

Call for Participation 

NIST invites industry subject matter experts and practitioners to present their views related to challenges to implementation, operations, and security associated with migration to new cryptographic algorithms. The primary focus of the workshop is on challenges faced by developers and implementers of cryptographic components, applications, operating systems, and network protocols. The workshop provides an opportunity for participants provide feedback on all aspects of the planned activities to include: impacted protocols, relevant standards, guidelines, recommended practices, use cases and technologies to be considered, and sources of specifications and guidance. NIST will use the resulting prioritized list of activities to help accelerate the development of a playbook for migration to post-quantum cryptography.  Requests to present at this workshop should be submitted to applied-crypto-pqc@nist.gov no later than August 10, 2020

This is an invitational workshop. If you are interested in participating in the workshop, please submit to applied-crypto-pqc@nist.gov a no more than one-page description of your interest to one or more of the following topics:

  • understanding the data formats and application programing interfaces of cryptographic libraries to support necessary changes and replacements
  • development of replacement hardware, software, and firmware that employ post-quantum algorithms
  • communications protocol implications of replacing current quantum-vulnerable public key algorithms
  • identification of your or your customers’ applications that employ current quantum-vulnerable public key algorithms
  • identification of protocols used by your organization or your customer organizations that employ current quantum-vulnerable public key algorithms
  • development of new or updated policies, standards, recommended practices or practices for installing, configuring and operating applications and systems that employ post-quantum algorithms
  • development of a roadmap for migrating systems and applications used by your organization or your customers from current public key algorithms to post-quantum algorithms

Those submitting these one-page descriptions will be invited to register up to three individuals for this virtual workshop. Submissions should be made no later than August 10, and registration will close on August 17. The workshop will be limited to 200 participants.

The workshop will be recorded and the content will be made available after the event. Please join the community of interest by sending an email to applied-crypto-pqc@nist.gov to get the latest updates on the activities related to Migrating to Post-Quantum Cryptographic Algorithms.


Agenda

 11:00 – 11:10 a.m.   

 NIST and NCCoE Overview

 11:10 – 11:25   

 Workshop Overview & Background

 11:25 – 11:45   

 Status of NIST PQC Activity

 11:45 – 11:55   

 Moderated Q&A

 11:55 – 12:00 p.m. 

 Break

 12:00 – 13:00   

 Challenges Session

  • Standard Developing Organizations (SDOs)
  • Hardware/Software Development and Production
  • Integration Challenges
  • Customer Challenges

 13:00 – 13:10   

 Moderated Q & A

 13:10 – 13:15     

 Break

 13:15 – 14:00   

 Five Minute Participant Lightning Talk Session

 14:00 – 14:15   

 Moderated Q & A

 14:15 – 14:30 p.m.   

 Next Steps/Wrap-up (NCCoE)

 

Questions? 

Please send an email to applied-crypto-pqc@nist.gov

 

De-mystifying Secure Software Development Webinar

Tuesday, June 23, 2020

Background

Once seen as only tangential to cybersecurity planning, software security has recently emerged as a top priority for policymakers, businesses, and users around the world. As our collective understanding of cybersecurity has grown, we have come to recognize the central role secure design and development plays in protecting the software that powers our world. Unfortunately, software security discussions have long been hampered by inconsistent terminology, lack of clarity around best practices, and a sense that only the most technically inclined could ever really make sense of the process. A new software development framework from NIST is poised to change all that.

Much like it did with its Cybersecurity Framework, NIST has brought together what we have learned about software security over the past two decades and created a secure software development framework (SSDF) that can get us all talking from the same playbook. The framework builds on SAFECode’s publications on secure development best practices, the BSA Framework for Secure Software, and other industry contributions to deliver a core set of high-level secure software development practices that help ensure that software is secure by design. Software producers who follow these practices can reduce the number of vulnerabilities in released software, mitigate the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to achieve continuous improvement of software security. Software consumers can use the framework to confidently build their security requirements and apply them as applicable to their software acquisition processes.

Event Details

Please register here to join BSA and SAFECode along with government and industry panelists in a virtual roundtable discussion on Tuesday, June 23 from 11 a.m. to 1 p.m. to learn about the SSDF and hear about its practical applications for product developers, public and private sector customers, and the future of product certifications and labeling.

Questions about this session should be directed to BSA’s Tommy Ross (thomasr@bsa.org) or SAFECode’s Steve Lipner (lipner@safecode.org). 

Agenda

Slides from this session can be found here
 
11:00 - 11:05 a.m.
Welcome remarks
Kevin Stine, NIST
 
11:05 - 11:20 a.m.
Introduction and overview of the NIST Secure Software Development Framework
Karen Scarfone, NIST Associate
 
11:20 - 11:30 a.m.
BSA’s perspective
Tommy Ross, BSA
 
11:30 - 11:40 a.m.
SAFECode’s perspective
Steve Lipner, SAFECode
  
11:40 - 11:55 a.m.
Q&As
BSA/NIST/SAFECode
Tommy Ross, Karen Scarfone, Kevin Stine, and Steve Lipner
 
12:05 - 12:45 p.m.
Perspectives on Applying the SSDF
  • Guiding Product Development:  Valecia Maclin, Microsoft
  • Supporting private sector software acquisition:  John Banghart, Venable
  • Improving government acquisition: Melinda Reed, DoD
  • Shaping interoperability, synergies, and evaluation: Prokopios Drogkaris and Apostolos Malatras, ENISA
 
12:45 - 12:55 p.m.
Q&As
Invited speakers
Valecia Maclin, John Banghart, Melinda Reed, Prokopios Drogkaris and Apostolos Malatras
 
12:55 - 13:00 p.m.
Closing remarks and next steps
BSA/NIST/SAFECode
Tommy Ross, Kevin Stine, and Steve Lipner

Energy Analytic Security Exchange Meeting

Tuesday, May 7, 2019

NCCoE Engineer Jim McCarthy will be speaking to Energy Analytic Security Exchange (EASE) members on their biweekly member analyst call on May 7. 

Attendees will incude EASE staff analysts and energy companies’ cyber and physical security analysts and managers and will cover how the NCCoE can be used as a resource to the community.

For more information, please visit or email membership@energy-ase.com

IoTSSA Podcast

Thursday, February 14, 2019

Join Brian (of IoTSSA) in a discussion on the NIST Cybersecurity Framework with Karen Waltermire, Cybersecurity Engineer with NIST and Harry Perper Dept Chief Engineer with The MITRE Corporation.

Under the parent organization NIST, the NCCOE (National Cybersecurity Center of Excellence) accelerates businesses’ adoption of standards-based, advanced security technologies. They consult with IT security professionals and other leaders to identify their most pressing cybersecurity issues so they may develop new and evolve current support programs for SMB’.

Making Mobile Access Secure and Convenient Using Derived PIV Credentials

Wednesday, December 12, 2018

The government workplace is already using tablets and/or smartphones to access secure data, but the existing technology available to reach this data securely can be unwieldy and somewhat outdated. In this webinar, scheduled for December 12 at 11:00 am, Intercede and the NCCoE will share how your organization can leverage derived PIV credentials to access important information securely and without it being a hassle.

Register for this webinar to learn:

  • What derived PIV credentials (DPC) are
  • How DPCs can help make access to mobile devices secure and convenient
  • What to consider in selecting a DPC solution

National Cybersecurity Awareness Month Webinar: Energy Sector

Tuesday, October 23, 2018

In support of National Cybersecurity Awareness Month, The National Cybersecurity Center of Excellence (NCCoE) invites you to join us on Wednesday, October 23, 2018 from 3-4 p.m. (ET). This webinar will provide an overview of NCCoE Energy Sector projects as well as a discussion lead by BlackRidge Technology on the Industrial Internet of Things (IIoT).

What to expect:

  • Information on NCCoE's past and current Energy Sector projects
  • Discussion on current and future cybersecurity challenges as they relate to IIoT
  • Question and Answer from the virtual audience

Hosts:

Jim McCarthy, Energy Program Lead, National Cybersecurity Center of Excellence

Michael Murray, Senior Vice President and General Manager of Cyber Physical Systems, BlackRidge Technology

John Walsh, Chief Strategy and Technology Officer, BlackRidge Technology

Radiant Logic Webinar

Thursday, August 30, 2018

Join us for a new webinar on Thursday, August 30 featuring Harry Perper, Chief Engineer on the project, to learn how the National Cybersecurity Center of Excellence (NCCoE) addressed these challenges and discover the role Radiant Logic played in the resulting reference architecture. Under the auspices of the National Institute of Standards and Technology (NIST), NCCoE, worked with experts from the financial services sector and technology partners to develop an ARM reference architecture.

R-CISC's Cyber Thursday

Thursday, September 6, 2018

With fraudulent online purchases on the rise, organizations need to protect their customers without overburdening the shopping experience. In this webinar, engineers from the National Cybersecurity Center of Excellence (NCCoE) will discuss the recently released NIST Cybersecurity Practice Guide SP 1800-17, Multifactor Authentication for E-Commerce, which demonstrates how an organization can use standards-based technologies to help prevent account takeovers and reduce online fraudulent purchases. Join us, along with R-CISC, to explore the MFA options used in the draft NIST Special Publication which are available to retailers today and see video demonstrations of these scenarios to select the option that best matches your organization’s goals and customer needs.

This webinar is open to R-CISC Members and eligible retail cybersecurity practitioners. Email events@r-cisc.org to RSVP today.

Preventing an Inside Job: Detection, Technology and People

Tuesday, June 12, 2018

Cybersecurity technology advances and NIST best practices along with automation and system controls go a long way to minimize errors, but it doesn't completely eliminate the potential for error by human actors. So how can you reduce the opportunity for and damage of a threat to your organization?

Join Harry Perper, Chief Engineer, NIST National Cybersecurity Center of Excellence, and Neha Gupta, CEO of True Office Learning as they discuss best practices for:

  • Optimizing technology and automation to identify and protect against insider threats;
  • Measuring the effectiveness or readiness of people processes;
  • Layering technology and people to minimize risk.