National Institute of Standards and Tech

DRAFT NIST SP 1800-24 Securing Picture Archiving and Communication System (PACS) The National Cybersecurity Center of Excellence at the National Institute of Standards and Technology built a laboratory to emulate a medical imaging environment, performed a risk assessment, and identified controls from the NIST Cybersecurity Framework to secure the medical imaging ecosystem. This project used Picture Archiving Communications Systems (PACS) and a Vendor Neutral Archive (VNA), and implemented controls to safeguard medical images from cybersecurity threats. PACS and VNA comprise the systems to centrally manage medical imaging data. Why buy a book you can download for free? We print the paperback book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the bound paperback from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these paperbacks as a service so you don't have to. The books are compact, tightly-bound paperback, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a HUBZONE SDVOSB. https: //usgovpub.com

FINAL NIST SP 800-160 Volume 2 released November 2019Developing Cyber Resilient Systems: A Systems Security Engineering Approach This publication is used in conjunction with NIST Special Publication 800-160, Volume 1, Systems Security Engineering-Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems and NIST Special Publication 800-37, Risk Management Framework for Information Systems and Organizations-A System Life Cycle Approach for Security and Privacy. It can be viewed as a handbook for achieving the identified cyber resiliency outcomes based on a systems engineering perspective on system life cycle processes in conjunction with risk management processes, allowing the experience and expertise of the organization to help determine what is correct for its purpose. Organizations can select, adapt, and use some or all of the cyber resiliency constructs (i.e., objectives, techniques, approaches, and design principles) described in this publication and apply the constructs to the technical, operational, and threat environments for which systems need to be engineered. The system life cycle processes and cyber resiliency constructs can be used for new systems, system upgrades, or repurposed systems; can be employed at any stage of the system life cycle; and can take advantage of any system or software development methodology including, for example, waterfall, spiral, or agile. Why buy a book you can download for free? We print the paperback book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the bound paperback from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these paperbacks as a service so you don't have to. The books are compact, tightly-bound paperback, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a SDVOSB. https: //usgovpub.com

FINAL - Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C) Most of the routing infrastructure underpinning theinternetcurrentlylacksbasic security services. In most cases, internettraffic must transit multiple networks before reaching its destination. Each network implicitly trusts other networks to provide (via BGP) the accurate information necessaryto correctly route traffic across the internet. When that information is inaccurate, traffic will take inefficient paths through theinternet, arrive at malicious sites that masquerade as legitimate destinations, or never arrive at its intended destination. These impacts can be mitigated through a widespread adoption ofBGP ROV. Why buy a book you can download for free? We print the paperback book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the bound paperback from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these paperbacks as a service so you don't have to. The books are compact, tightly-bound paperback, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a HUBZONE SDVOSB. https: //usgovpub.com

NIST SP 800-175B Rev. 1 (March 2020) and NISTIR 7298 Rev. 3 (July 2019)This book includes the following: NIST SP 800-175B Rev. 1 Guideline for Using Cryptographic Standards in the Federal GovernmentNISTIR 7298 Rev. 3 Glossary of Key Information Security Terms NIST SP 800-175B is intended to provide guidance to the Federal Government for using cryptography and NIST's cryptographic standards to protect sensitive, but unclassified digitized information during transmission and while in storage. The cryptographic methods and services to be used are discussed. NISTIR 7298 Rev. 3 describes an online glossary of terms used in National Institute of Standards and Technology (NIST) and Committee on National Security Systems (CNSS) publications. This glossary utilizes a database of terms extracted from NIST Federal Information Processing Standard Publications (FIPS), the NIST Special Publication (SP) 800 series, select NIST Interagency or Internal Reports (NISTIRs), and from the Committee for National Security Systems Instruction 4009 (CNSSI-4009). Why buy a book you can download for free? We print the paperback book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the bound paperback from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these paperbacks as a service so you don't have to. The books are compact, tightly-bound paperback, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a HUBZONE SDVOSB. https: //usgovpub.com

Released June 18 2019 Why buy a book you can download for free? We print the paperback book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the bound paperback from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these paperbacks as a service so you don't have to. The books are compact, tightly-bound paperback, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a HUBZONE SDVOSB. https: //usgovpub.comBuy the paperback from Amazon and get Kindle eBook FREE using MATCHBOOK. go to https: //usgovpub.com to learn how

DRAFT May 2019A randomness beacon produces timed output so fresh public randomness. Each output, called a pulse, also includes metadata and cryptographic elements to support several security and usability features. This document specifies a reference "version2" of a format for pulses and of a protocol for beacon operations. The main goal of the description is to serve as a baseline for the deployment of numerous interoperable beacons, including the NIST Beacon. In the proposed reference, a Beacon periodically outputs a pulse containing 512 fresh random bits, time-stamped, signed and hash-chained. For example, each pulse also pre-commits to the randomness to be released in the next pulse. The latter enables users to securely combine randomness from different beacons. The Beacon protocol also specifies the interface for users to interact with the Beacon, in order to obtain information about past pulses. Why buy a book you can download for free? We print the paperback book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the bound paperback from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these paperbacks as a service so you don't have to. The books are compact, tightly-bound paperback, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a HUBZONE SDVOSB. https: //usgovpub.comBuy the paperback from Amazon and get Kindle eBook FREE using MATCHBOOK. go to https: //usgovpub.com to learn how

PRINTED IN FULL COLOR - May 2019 Healthcare Delivery Organizations (HDOs) are leveraging a combination of telehealth capabilities, such as remote patient monitoring (RPM) and videoconferencing, to treat patients in their homes. These modalities are used to treat numerous conditions, such as patients battling chronic illness or requiring postoperative monitoring. As use of these capabilities continues to grow, it is important to ensure that the infrastructure supporting them can maintain the confidentiality, integrity, and availability of patient data, and to ensure the safety of patients. It is also important to ensure the privacy of patient data by considering the privacy engineering objectives of predictability, manageability, and disassociability of data. The goal of this project is to provide a practical solution for securing the telehealth RPM ecosystem. NIST encourage technology providers to submit a Letter of Interest should they have a commercially available product suited for the build. This book includes the Department of Homeland Security document titled: "HIPAA Security Rule Crosswalk to NIST Cybersecurity Framework". Why buy a book you can download for free? We print the paperback book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the bound paperback from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these paperbacks as a service so you don't have to. The books are compact, tightly-bound paperback, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a HUBZONE SDVOSB. https: //usgovpub.comBuy the paperback from Amazon and get Kindle eBook FREE using MATCHBOOK. go to https: //usgovpub.com to learn how

Rev 1 released February 2019This document gives recommendations and guidelines for enhancing trust in email. The primary audience includes enterprise email administrators, information security specialists and network managers. This guideline applies to federal IT systems and will also be useful for small or medium sized organizations. Technologies recommended in support of core Simple Mail Transfer Protocol (SMTP) and the Domain Name System (DNS) include mechanisms for authenticating a sending domain: Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM) and Domain based Message Authentication, Reporting and Conformance (DMARC). Recommendations for email transmission security include Transport Layer Security (TLS) and associated certificate authentication protocols. Recommendations for email content security include the encryption and authentication of message content using S/MIME (Secure/Multipurpose Internet Mail Extensions) and associated certificate and key distribution protocols. Why buy a book you can download for free? We print this book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. We look over each document carefully and replace poor quality images by going back to the original source document. We proof each document to make sure it's all there - including all changes. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the latest version from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these large documents as a service so you don't have to. The books are compact, tightly-bound, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a HUBZONE SDVOSB. https: //usgovpub.com

NIST Whitepaper. Traditionally, patient monitoring systems have been deployed in healthcare facilities, in controlled environments. Remote patient monitoring (RPM), however, is different in that monitoring equipment is deployed in the patient's home. These new capabilities, which can involve third-party platform providers utilizing videoconferencing capabilities, and leveraging cloud and internet technologies coupled with RPM devices, are used to treat numerous conditions, such as patients battling chronic illness or requiring post-operative monitoring. Why buy a book you can download for free? We print this book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. We look over each document carefully and replace poor quality images by going back to the original source document. We proof each document to make sure it's all there - including all changes. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the latest version from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these large documents as a service so you don't have to. The books are compact, tightly-bound, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a HUBZONE SDVOSB. https: //usgovpub.com

NIST SP 1800-19A & B, Trusted Cloud - Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments. Draft released November 20, 2018. Printed in COLOR. Cloud services can provide organizations the opportunity to increase their flexibility, availability, resiliency, and scalability, which they can use in turn to increase security, privacy, efficiency, responsiveness, innovation, and competitiveness. The core impediments to an organization's broader adoption of cloud technologies are the ability to protect its information and virtual assets in the cloud, and to have sufficient visibility so it can conduct oversight and ensure that it (and its cloud provider) are complying with applicable laws and business practices. The National Cybersecurity Center of Excellence (NCCoE) at NIST built a laboratory environment using commercial off-the-shelf technology and cloud services to safeguard the security and privacy of an organization's applications and data being run within or transferred between private and hybrid/public clouds. Why buy a book you can download for free? We print this book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. We look over each document carefully and replace poor quality images by going back to the original source document. We proof each document to make sure it's all there - including all changes. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the latest version from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these large documents as a service so you don't have to. The books are compact, tightly-bound, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a HUBZONE SDVOSB. https: //usgovpub.com

NIST Special Publication 800-57 Part 2 Rev 1 Released May 2019 This book provides cryptographic key management guidance. It consists of three parts. Part 1, Recommendation for Key Management, Part 1: General, provides general guidance and best practices for the management of cryptographic keying material. Part 2, Best Practices for Key Management Organizations, provides guidance on policy and security planning requirements. Part 3, Recommendation for Key Management, Application-Specific Key Management Guidance, provides guidance when using the cryptographic features of current systems. Part 2 (this document) 1) identifies the concepts, functions and elements common to effective systems for the management of symmetric and asymmetric keys; 2) identifies the security planning requirements and documentation necessary for effective institutional key management; 3) describes key management specification requirements; 4) describes cryptographic key management policy documentation that is needed by organizations that use cryptography; and 5) describes key management practice statement requirements. Appendices provide examples of some key management infrastructures and supplemental documentation and planning materials. Why buy a book you can download for free? We print this book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. We look over each document carefully and replace poor quality images by going back to the original source document. We proof each document to make sure it's all there - including all changes. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the latest version from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these large documents as a service so you don't have to. The books are compact, tightly-bound, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a HUBZONE SDVOSB. https: //usgovpub.com

Buy the paperback from Amazon and get Kindle eBook FREE using MATCHBOOK. go to www.usgovpub.com to learn how Since the release of the last edition of the NIST Smart Grid Framework and Roadmap for Interoperability Standards (Release 2.0), in February 2012, significant technological advances in smart grid infrastructure have been implemented, supported by standards development across the entire smart grid arena. Examples include widespread deployment of wireless-communication power meters, availability of customer energy usage data through the Green Button initiative, remote sensing for determining real-time transmission and distribution status, and protocols for electric vehicle charging. Why buy a book you can download for free? We print this book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. We look over each document carefully and replace poor quality images by going back to the original source document. We proof each document to make sure it's all there - including all changes. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the latest version from Amazon.com This book includes original commentary which is copyright material. We print these large documents as a service so you don't have to. The books are compact, tightly-bound, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a SDVOSB. www.usgovpub.com If you like the service we provide, please leave positive review on Amazon.com.

Released Oct 15, 2018 Buy the paperback from Amazon and get Kindle eBook FREE using MATCHBOOK. go to www.usgovpub.com to learn how Transport Layer Security (TLS) provides mechanisms to protect data during electronic dissemination across the Internet. This Special Publication provides guidance to the selection and configuration of TLS protocol implementations while making effective use of Federal Information Processing Standards (FIPS) and NIST-recommended cryptographic algorithms. It requires that TLS 1.2 configured with FIPS-based cipher suites be supported by all government TLS servers and clients and requires support of TLS 1.3 by January 1, 2024. This Special Publication also provides guidance on certificates and TLS extensions that impact security. Why buy a book you can download for free? We print this book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. We look over each document carefully and replace poor quality images by going back to the original source document. We proof each document to make sure it's all there - including all changes. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the latest version from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these large documents as a service so you don't have to. The books are compact, tightly-bound, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a SDVOSB. https: //usgovpub.com

Updated June 2019 The Internet of Things (IoT) is a rapidly evolving and expanding collection of diverse technologies that interact with the physical world. Many organizations are not necessarily aware of the large number of IoT devices they are already using and how IoT devices may affect cybersecurity and privacy risks differently than conventional information technology (IT) devices do. The purpose of this publication is to help federal agencies and other organizations better understand and manage the cybersecurity and privacy risks associated with their IoT devices throughout their lifecycles. Why buy an eBook when you can access data on a website for free? HYPERLINKSFirst you gotta find it and make sure it's the latest version, not always easy. It's much more cost-effective to just order the latest version from Amazon.comAnyone that has worked with this document knows how difficult it is to search to find that one bit of critical information. You could go to a government web site and click thru pages endlessly. Not only is it time consuming, but it is exhausting. This book is more than 1,530 pages long, so printing that out on a network printer is out of the question. ePublishing changes all that. Yes, the book is available as a PDF file, but how easy is it to navigate a large PDF document on a mobile device? Do you really want to search a PDF document manually? Load this copy onto your Kindle, PC, iPad, Android Tablet, Nook, or iPhone (download the FREE kindle App from the APP Store) and you have an easily searchable copy. We recommend the Kindle Paperwhite. It's inexpensive, has long battery life (weeks) and can hold a lot of documents. Most devices will allow you to easily navigate this ePub version to any Chapter. Note that there is a distinction between a Table of Contents and "Page Navigation". Page Navigation refers to a different sort of Table of Contents. Not one appearing as a page in the book, but one that shows up on the device itself when the reader accesses the navigation feature. Readers can click on a navigation link to jump to a Chapter or Subchapter. Once there, most devices allow you to "pinch and zoom" in or out to easily read the text. (Unfortunately, downloading the free sample file at Amazon.com does not include this feature. You have to buy a copy to get that functionality, but as inexpensive as this is, it's worth it.) Kindle allows you to do word search and Page Flip (temporary place holder takes you back when you want to go back and check something). usgovpub.com This book includes original commentary which is copyright material. 4th Watch Publishing Co. is not affiliated with the National Institute of Standards and Technology.

NIST SP 1800-17 Printed in COLORE-commerce fraud increased by 30 percent in 2017, compared to 2016. This is linked to the improvements in EMV credit card technology in the United States, which has shifted malicious actors away from using stolen credit card data in stores at the checkout counter to using stolen credit card data for fraudulent online shopping. This increase in e-commerce fraud mirrors a similar increase observed in Europe following the rollout of similar credit card technology enhancements. Because online retailers cannot utilize all of the benefits of improved credit card technology, they should consider implementing stronger authentication to reduce the risk of e-commerce fraud. This guide explores several risk-based scenarios that use MFA to increase assurance of the purchaser's identity and to reduce fraudulent online purchases. Retailers can implement multifactor authentication (MFA) to reduce the opportunity for a customer's online account to be used for fraudulent purchases. MFA is a security enhancement that allows a user to present several pieces of evidence when logging into an account. This evidence falls into three categories: something you know (e.g., password), something you have (e.g., smart card), and something you are (e.g., fingerprint). The presented evidence must come from at least two different categories to enhance security. Why buy a book you can download for free? We print this book so you don't have to. First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. We look over each document carefully and replace poor quality images by going back to the original source document. We proof each document to make sure it's all there - including all changes. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the latest version from Amazon.com This book includes original commentary which is copyright material. Note that government documents are in the public domain. We print these large documents as a service so you don't have to. The books are compact, tightly-bound, full-size (8 1/2 by 11 inches), with large text and glossy covers. 4th Watch Publishing Co. is a SDVOSB. www.usgovpub.com