Items from security-related news (E95.Mar-2010)


NIST Publications



Mar. 18, 2010
SP 800-128
DRAFT Guide for Security Configuration Management of Information Systems
http://csrc.nist.gov/publications/drafts/800-128/draft_sp800-128-ipd.pdf

NIST announces the publication of Initial Public Draft Special Publication 800-128, Guide for Security Configuration Management of Information Systems. The publication provides guidelines for managing the configuration of information system architectures and associated components for secure processing, storing, and transmitting of information. Security configuration management is an important function for establishing and maintaining secure information system configurations, and provides important support for managing organizational risks in information systems.

NIST requests comments on the Initial Public Draft of Special Publication 800-128, by June 14, 2010. Please submit comments to sec-cert@nist.gov.


Mar. 18, 2010
NIST IR-7676
DRAFT Maintaining and Using Key History on Personal Identity Verification (PIV) Cards
http://csrc.nist.gov/publications/drafts/800-128/draft-nistir-7676.pdf

NIST announces that Draft NIST Interagency Report 7676, Maintaining and Using Key History on Personal Identity Verification (PIV) Cards, has been released for public comment.

NIST requests comments on Draft NIST IR 7676 by 5:00pm EDT on April 23, 2010. Please submit your comments to PIV_comments@nist.gov with "Comments on Public Draft NISTIR 7676" in the subject line.


Mar. 10, 2010
NIST IR-7669
DRAFT Open Vulnerability Assessment Language (OVAL) Validation Program Derived Test Requirements
http://csrc.nist.gov/publications/drafts/nistir-7669/draft-nistir-7669.pdf

Draft NIST Interagency Report (IR) 7669, Open Vulnerability Assessment Language (OVAL) Validation Program Derived Test Requirements, describes the requirements that must be met by products to achieve OVAL Validation. Validation is awarded based on a defined set of OVAL capabilities by independent laboratories that have been accredited for OVAL testing by the NIST National Voluntary Laboratory Accreditation Program. Draft NISTIR 7669 has been written primarily for accredited laboratories and for vendors interested in receiving OVAL validation for their products.

If you have questions or want to send comments regarding this document, please send email to: IR7669comments@nist.gov. There is a 30-day period for comments and the deadline to submit comments is Friday, April 9, 2010.


Feb. 22, 2010
SP 800-119
DRAFT Guidelines for the Secure Deployment of IPv6
http://csrc.nist.gov/publications/drafts/800-119/draft-sp800-119_feb2010.pdf

NIST announces the public comment release of Special Publication (SP) 800-119, Guidelines for the Secure Deployment of IPv6. IPv6 (Internet Protocol version 6) is the next generation Internet Protocol, accommodating vastly increased address space. This document describes and analyzes IPv6's new and expanded protocols, services, and capabilities, including addressing, DNS, routing, mobility, quality of service, multihoming, and IPsec. For each component, there is a detailed analysis of the differences between IPv4 and IPv6, the security ramifications and any unknown aspects. It characterizes new security threats posed by the transition to IPv6 and provides guidelines on IPv6 deployment, including transition, integration, configuration, and testing. It also addresses more recent significant changes in the approach to IPv6 transition.

NIST requests comments on Draft SP 800-119 by April 23, 2010. Please submit comments to draft-sp800-119-comments@nist.gov with "Comments SP 800-119" in the subject line.


Feb. 2, 2010
NIST IR-7628
DRAFT Smart Grid Cyber Security Strategy and Requirements
http://csrc.nist.gov/publications/drafts/800-119/draft-nistir-7628_2nd-public-draft.pdf

NIST announces that the second draft of NIST IR 7628, Smart Grid Cyber Security Strategy and Requirements, is now available for public comment. The second draft of the document contains the updated overall security strategy for the Smart Grid and updated logical interface diagrams, privacy, bottom-up analysis, and vulnerability class analysis sections. In addition, new chapters on research and development themes and standards assessment have been included. Finally, an overall functional logical Smart Grid architecture is included.

Please submit comments to cswgdraft2comments@nist.gov