Items from security-related news (E95.Mar-2010)
NIST Publications
Mar. 18, 2010
NIST announces the publication of Initial Public Draft Special
Publication 800-128, Guide for Security Configuration Management of
Information Systems. The publication provides guidelines for managing
the configuration of information system architectures and associated
components for secure processing, storing, and transmitting of
information. Security configuration management is an important
function for establishing and maintaining secure information system
configurations, and provides important support for managing
organizational risks in information systems.
NIST requests comments on the Initial Public Draft of Special
Publication 800-128, by June 14, 2010. Please submit comments to
sec-cert@nist.gov.
NIST announces that Draft NIST Interagency Report 7676, Maintaining
and Using Key History on Personal Identity Verification (PIV) Cards,
has been released for public comment.
NIST requests comments on Draft NIST IR 7676 by 5:00pm EDT on April
23, 2010. Please submit your comments to PIV_comments@nist.gov with
"Comments on Public Draft NISTIR 7676" in the subject line.
Draft NIST Interagency Report (IR) 7669, Open Vulnerability Assessment
Language (OVAL) Validation Program Derived Test Requirements,
describes the requirements that must be met by products to achieve
OVAL Validation. Validation is awarded based on a defined set of OVAL
capabilities by independent laboratories that have been accredited for
OVAL testing by the NIST National Voluntary Laboratory Accreditation
Program. Draft NISTIR 7669 has been written primarily for accredited
laboratories and for vendors interested in receiving OVAL validation
for their products.
If you have questions or want to send comments regarding this
document, please send email to: IR7669comments@nist.gov. There is a
30-day period for comments and the deadline to submit comments is
Friday, April 9, 2010.
NIST announces the public comment release of Special Publication (SP)
800-119, Guidelines for the Secure Deployment of IPv6. IPv6 (Internet
Protocol version 6) is the next generation Internet Protocol,
accommodating vastly increased address space. This document describes
and analyzes IPv6's new and expanded protocols, services, and
capabilities, including addressing, DNS, routing, mobility, quality of
service, multihoming, and IPsec. For each component, there is a
detailed analysis of the differences between IPv4 and IPv6, the
security ramifications and any unknown aspects. It characterizes new
security threats posed by the transition to IPv6 and provides
guidelines on IPv6 deployment, including transition, integration,
configuration, and testing. It also addresses more recent significant
changes in the approach to IPv6 transition.
NIST requests comments on Draft SP 800-119 by April 23, 2010. Please
submit comments to draft-sp800-119-comments@nist.gov with "Comments SP
800-119" in the subject line.
NIST announces that the second draft of NIST IR 7628, Smart Grid Cyber
Security Strategy and Requirements, is now available for public
comment. The second draft of the document contains the updated overall
security strategy for the Smart Grid and updated logical interface
diagrams, privacy, bottom-up analysis, and vulnerability class
analysis sections. In addition, new chapters on research and
development themes and standards assessment have been
included. Finally, an overall functional logical Smart Grid
architecture is included.
Please submit comments to cswgdraft2comments@nist.gov
SP 800-128
DRAFT Guide for Security Configuration Management of Information Systems
http://csrc.nist.gov/publications/drafts/800-128/draft_sp800-128-ipd.pdf
Mar. 18, 2010
NIST IR-7676
DRAFT Maintaining and Using Key History on Personal Identity
Verification (PIV) Cards
http://csrc.nist.gov/publications/drafts/800-128/draft-nistir-7676.pdf
Mar. 10, 2010
NIST IR-7669
DRAFT Open Vulnerability Assessment Language (OVAL) Validation Program
Derived Test Requirements
http://csrc.nist.gov/publications/drafts/nistir-7669/draft-nistir-7669.pdf
Feb. 22, 2010
SP 800-119
DRAFT Guidelines for the Secure Deployment of IPv6
http://csrc.nist.gov/publications/drafts/800-119/draft-sp800-119_feb2010.pdf
Feb. 2, 2010
NIST IR-7628
DRAFT Smart Grid Cyber Security Strategy and Requirements
http://csrc.nist.gov/publications/drafts/800-119/draft-nistir-7628_2nd-public-draft.pdf