[ISN] NIST revises IT security guides

http://www.gcn.com/online/vol1_no1/46561-1.html

By William Jackson
GCN.com
06/30/08 

The National Institute of Standards and Technology has released final 
revisions to three of its 800 series of special publications on 
information technology security.

NIST calls SP 800-79-1 [1], titled "Guidelines for the Accreditation of 
Personal Identity Verification Card Issuers," a substantial improvement 
over the original version.

PIV cards can be used across agencies for physical and logical access. 
They incorporate a common set of identity proofing and issuing 
standards, as well as other technologies. Each agency will be 
responsible for certifying and accrediting the issuer of its cards. 
Certification is the process of assessing the reliability, availability 
and capabilities of the issuer's personnel, equipment, finances and 
support infrastructure. A designated authority within an agency performs 
accreditation -- the management decision to authorize operation.

The agency also released SP 800-53A [2], an addendum to the "Guide for 
Assessing the Security Controls in Federal Information Systems." The 
publication provides comprehensive assessment procedures for the 
security controls spelled out in SP 800-53 and important guidance for 
agencies in building effective security assessment plans.

NIST is charged under the Federal Information Security Management Act 
(FISMA) with developing standards and guidance for implementing IT 
security programs. SP 800-53 is part of a series of documents developed 
for selecting the proper level and types of security controls. The core 
of the series is Federal Information Processing Standard 200, which 
establishes minimum security requirements under FISMA. Once those 
requirements have been met, agencies choose the appropriate set of 
controls from NIST SP 800-53, "Recommended Security Controls for Federal 
Information Systems." SP 800-53A is an addendum that defines the 
framework for conducting mandatory assessments of security controls 
required under FISMA.

Appendix J of SP 800-53A describes supplemental assessment cases that 
agencies can use in that process. An interagency task force is 
developing the assessment cases as part of the Assessment Case 
Development Project, and NIST officials expect to post them on the 
agency's Web site [3] in late July.

NIST has also updated SP 800-67 Version 1.1, titled "Recommendation for 
the Triple Data Encryption Algorithm Block Cipher." SP 800-67 gives 
specifications for TDEA, including its primary cryptographic engine, the 
Data Encryption Algorithm. When properly deployed in a cryptographic 
module that complies with FIPS 140-2, the algorithm can be used to 
protect federal information categorized as sensitive but unclassified.

"This recommendation precisely defines the mathematical steps required 
to cryptographically protect data using TDEA and to subsequently process 
such protected data," the publication states. The revision modifies the 
list of weak keys, correcting two of them. A note states that the actual 
values of the parity bits were ignored when listing the weak and 
semi-weak keys.

Major changes in SP 800-79-1 regarding accreditation of PIV card issuers 
(PCIs) take into account emerging business models, lessons learned from 
past accreditations and directives from the Office of Management and 
Budget. The most significant change is the replacement of "Attributes" 
with an objective set of controls and a methodology for assessing the 
capability and reliability of issuers.

The accreditation methodology consists of:

    * Deriving PCI controls from requirements in FIPS 201-1, OMB 
      memoranda and other documents.
    * Putting the controls into the context of hierarchical concepts 
      such as PCI Accreditation Topics and PCI Accreditation Focus 
      Areas.
    * Developing assessment methods for each PCI control that will 
      assess conformance to those underlying requirements.
    * Guidance for evaluating assessments in order to make an 
      accreditation decision.

[1] http://csrc.nist.gov/publications/nistpubs/800-79-1/SP800-79-1.pdf
[2] http://csrc.nist.gov/publications/nistpubs/800-53-Rev2/sp800-53-rev2-final.pdf
[3] http://csrc.nist.gov/sec-cert
[4] http://csrc.nist.gov/publications/nistpubs/800-67/SP800-67.pdf

Copyright 1996-2008 1105 Media, Inc. All Rights Reserved.


_______________________________________________      
Attend Black Hat USA, August 2-7 in Las Vegas, 
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings 
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.  
Visit product displays by 30 top sponsors in 
a relaxed setting. http://www.blackhat.com