Computer Security Division 2012 Annual Report
Patrick D. O'Reilly, Lorie Richards · 2013
With the continued proliferation of information, the explosion of devices connecting to the expanding communication infrastructure and the evolving threat environment, the need for cybersecurity standards and best practices that address interoperability, usability and privacy continues to be critical for the Nation.The Computer Security Division (CSD), a component of the Information Technology Laboratory at the National Institute of Standards and Technology (NIST) is responsible for developing standards, guidelines, tests, and metrics for the protection of non-national security federal information and communication infrastructure.These standards, guidelines, tests, and metrics are also important resources for the private sector.In 2012, CSD aligned its resources to enable greater development and application of practical, innovative security technologies and methodologies, and to enhance our ability to address current and future computer and information security challenges in support of critical national and international priorities.CSD extended its research and development agenda for high-quality, cost-effective security and privacy mechanisms to foster improved information security across the federal government and the global information security community.In 2012, NIST concluded the five-year SHA-3 Cryptographic Hash Algorithm Competition with the selection of KECCAK for standardization and worldwide adoption.The selection of this cryptographic hash algorithm, an indispensable component for the information and communication systems that support commerce in the modern era, confirmed NIST's well-respected and trusted technical authority in this field.A strong partnership with industry is vital to the success of our technical programs.In 2012, CSD engaged the international standards community on emerging technical standards to advance continuous monitoring capabilities and to further interoperability with commercially available tools.We also devised new security testing methodologies for smart phone software app functionality.Our research in hardware-enabled security continued with the development of guidelines on mechanisms that measure and report the security state of BIOS.Our research also continued to expand into the cybersecurity aspects of cyber-physical and embedded systems, and the mechanisms for enabling and protecting public safety communications.Our ability to interact with the broad federal community continues to be critical to our success.This interaction helps to ensure that our research is consistent with national objectives related to or impacted by information security.This interaction is most prominent in our strengthened collaborations with the Department of Defense, the Intelligence Community, and the Committee on National Security Systems to establish a common foundation for information security across the federal government.The release of Special Publication 800-30, Guide for Conducting Risk Assessments, developed by the Joint Task Force Transformation Initiative Interagency Working Group, is not only leading to more consistent ways to assess risks, but is also enabling more effective risk management and facilitating greater sharing of information across organizational boundaries.For many years, the Computer Security Division (CSD), in collaboration with our global partners from government, industry, and academia, has made great contributions to help secure the nation's critical information and infrastructure.We look forward to furthering these relationships in 2013 as we lead in examining the diverse cybersecurity aspects of a broad set of areas, including supply chain risk management; security analytics; cloud, mobile, and privacy-enhancing technologies; hardware-enabled security; and cyber-physical and embedded systems.