Tag: nist
-
NIST Still Struggling to Clear Vulnerability Submissions Backlog in NVD
The effects of the backlog is already being felt in vulnerability management circles where NVD data promises an enriched source of truth. The post NIST Still Struggling to Clear Vulnerability Submissions Backlog in NVD appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/nist-still-struggling-to-clear-vulnerability-submissions-backlog-in-nvd/
-
CISOs are taking on ever more responsibilities and functional roles has it gone too far?
Tags: ai, business, cio, ciso, cloud, compliance, computing, control, corporate, cyber, cybersecurity, data, defense, framework, fraud, governance, healthcare, infosec, intelligence, international, Internet, jobs, law, mitigation, nist, privacy, regulation, resilience, risk, risk-management, service, skills, software, supply-chain, technology, threatth century alongside technology and internet-enabled threats, morphing to meet the demands of the moment. But the position hasn’t just matured; in many cases it has expanded, taking on additional domains.”The CISO role has expanded significantly over the years as companies realize that information security has a unique picture of what is going on across…
-
UK cyber agency suggests 2035 deadline to move to quantum-safe encryption, warns of threats
Tags: banking, cloud, computing, cyber, cybersecurity, encryption, finance, infrastructure, nist, risk, service, threat, vulnerabilityChallenges for enterprises: The NCSC’s roadmap underscores the urgency of transitioning to PQC, but businesses may face significant challenges in meeting the proposed timelines.The migration process could be complex, costly, and disruptive, requiring organizations to overhaul encryption protocols embedded in critical infrastructure, financial systems, and cloud services.Kawoosa pointed out that while enterprises typically have basic…
-
NIST Announces HQC as Fifth Standardized Post Quantum Algorithm
First choices for both KEMs and DSAs are already standardized, and organizations should not wait for the backups to be available before migrating to PQC. The post NIST Announces HQC as Fifth Standardized Post Quantum Algorithm appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/nist-announces-hqc-as-fifth-standardized-post-quantum-algorithm/
-
Week in review: NIST selects HQC for post-quantum encryption, 10 classic cybersecurity books
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: NIST selects HQC as backup algorithm for post-quantum encryption Last year, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/16/week-in-review-nist-selects-hqc-for-post-quantum-encryption-10-classic-cybersecurity-books/
-
NIST SP 800-171 Rev 2 vs Rev 3: What’s The Difference?
Government cybersecurity and information security frameworks are a constant work in progress. Many different frameworks draw their requirements from the National Institute of Standards and Technology, and one of the most important documents for cybersecurity is NIST Special Publication 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. One of the key pillars of……
-
Generative AI red teaming: Tips and techniques for putting LLMs to the test
Defining objectives and scopeAssembling a teamThreat modelingAddressing the entire application stackDebriefing, post-engagement analysis, and continuous improvementGenerative AI red teaming complements traditional red teaming by focusing on the nuanced and complex aspects of AI-driven systems including accounting for new testing dimensions such as AI-specific threat modeling, model reconnaissance, prompt injection, guardrail bypass, and more. AI red-teaming…
-
NIST Finalizes Differential Privacy Rules to Protect Data
The National Institute of Standards and Technology (NIST) released updated differential privacy guidelines for organizations to follow to protect personally identifiable information when sharing data. First seen on darkreading.com Jump to article: www.darkreading.com/data-privacy/nist-finalizes-differential-privacy-rules-to-protect-data
-
NIST selects HQC as backup algorithm for post-quantum encryption
Last year, NIST standardized a set of encryption algorithms that can keep data secure from a cyberattack by a future quantum computer. Now, NIST has selected a backup … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/12/nist-hqc-post-quantum-encryption-algorithm/
-
NIST Releases New Report on Crypto-Agility What You Need to Know Now
If you’re keeping up with post-quantum cryptography (PQC), here’s some big news: The U.S. National Institute of Standards and Technology (NIST) has released a fresh initial public draft of a Cybersecurity Whitepaper titled Considerations for Achieving Crypto-Agility. This whitepaper tackles the real-world challenges and trade-offs involved in cryptographic transitions and discusses key strategies for achieving……
-
What is risk management? Quantifying and mitigating uncertainty
Tags: breach, business, cio, ciso, compliance, control, cyber, cyberattack, data, finance, flaw, framework, governance, healthcare, infosec, infrastructure, insurance, international, jobs, mitigation, monitoring, nist, risk, risk-analysis, risk-assessment, risk-management, software, strategy, technology, tool, vulnerabilityHow do organizations structure risk management operations?: Risk management has in some organizations traditionally been multicentric, with different departments or individuals within the org implementing risk management techniques in their work: Risk management is a component of good project management, for instance. IT leaders in particular must be able to integrate risk management philosophies and…
-
House passes bill requiring federal contractors to have vulnerability disclosure policies
The legislation to make contractors implement VDPs aligned with NIST guidelines is aimed at protecting Americans’ data, co-sponsor Rep. Nancy Mace says. First seen on cyberscoop.com Jump to article: cyberscoop.com/house-passes-federal-contractors-vdp-bill/
-
Is your enterprise ‘cyber resilient’? Probably not. Here’s how other boards fixed that
Tags: backup, breach, business, ciso, cloud, compliance, control, cyber, cyberattack, cybersecurity, endpoint, finance, framework, governance, incident, metric, monitoring, nist, resilience, risk, service, strategy, supply-chain, tool, training, vulnerability, vulnerability-managementLockheed Martin: Lockheed Martin introduced its Cyber Resiliency Level (CRL) Framework and corresponding Scoreboard in 2018, illustrating a more formalized approach to measuring cyber resilience during this period. The company’s Cyber Resiliency Scoreboard includes tools like a questionnaire and dashboard for measuring the maturity levels of six categories, including Cyber Hygiene and Architecture.MIT: The Balanced Scorecard for Cyber Resilience (BSCR) provides…
-
What is zero trust? The security model for a distributed and risky era
Tags: access, ai, authentication, best-practice, breach, business, ceo, cloud, compliance, computer, computing, control, corporate, credentials, cyberattack, data, detection, framework, government, guide, identity, infrastructure, intelligence, jobs, login, monitoring, network, nist, office, password, ransomware, regulation, risk, saas, service, technology, threat, tool, vpn, zero-trustHow zero trust works: To visualize how zero trust works, consider a simple case: a user accessing a shared web application. Under traditional security rules, if a user was on a corporate network, either because they were in the office or connected via a VPN, they could simply click the application and access it; because…
-
Google Integrates Quantum-Safe Digital Signatures
Computing Giant Warns Against Future Decryption of Secure Communications. Google adopted quantum-safe digital signatures for its cloud environment designed to help users combat the next phase of adversarial attacks. The announcement from the company comes days after Microsoft unveiled its latest quantum chip. NIST formalized the algorithms in August 2024. First seen on govinfosecurity.com Jump…
-
What is anomaly detection? Behavior-based analysis for cyber threats
a priori the bad thing that you’re looking for,” Bruce Potter, CEO and founder of Turngate, tells CSO. “It’ll just show up because it doesn’t look like anything else or doesn’t look like it’s supposed to. People have been tilting at that windmill for a long time, since the 1980s, trying to figure out what…
-
FedRAMP ConMon vs Audits: What’s the Difference?
A lot goes into protecting the information security of the nation. The National Institute of Standards and Technology, NIST, maintains a list of security controls under the banner of NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations. Meanwhile, the Federal Risk and Authorization Management Program, or FedRAMP, sets up a framework……
-
MSSP Market Update: Judy Security, Strike Graph Partner for NIST Compliance
First seen on scworld.com Jump to article: www.scworld.com/news/mssp-market-update-judy-security-strike-graph-partner-for-nist-compliance
-
It pays to know how your cybersecurity stacks up
Like all other business leaders, chief information security officers (CISOs) could find themselves on the unemployment line if something on their watch goes seriously sideways.But what if CISOs simply aren’t demonstrating enough business value?With companies cutting costs, proving cybersecurity programs are good for the business has become vital to protecting budgets and jobs. That’s why…
-
What 2025 HIPAA Changes Mean to You
Tags: access, application-security, authentication, breach, business, cloud, compliance, control, cybersecurity, data, encryption, healthcare, HIPAA, identity, incident response, insurance, law, mfa, monitoring, nist, office, penetration-testing, privacy, risk, risk-analysis, service, strategy, threat, tool, vulnerabilityWhat 2025 HIPAA Changes Mean to You madhav Tue, 02/04/2025 – 04:49 Thales comprehensive Data Security Platform helps you be compliant with 2025 HIPAA changes. You are going about your normal day, following routine process at your healthcare organization, following the same business process you’ve followed for the last twelve years. You expect Personal Health…
-
Using the NIST Phish Scale Framework to Detect and Fight Phishing Attacks
The NIST Phish Scale framework offers a structured and effective approach to improving phishing awareness training in organizations. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/02/using-the-nist-phish-scale-framework-to-detect-and-fight-phishing-attacks/
-
US takes aim at healthcare cybersecurity with proposed HIPAA changes
Tags: access, authentication, best-practice, breach, compliance, control, csf, cyber, cyberattack, cybersecurity, data, defense, detection, dora, encryption, finance, framework, government, group, healthcare, HIPAA, incident response, infrastructure, insurance, intelligence, jobs, law, malware, mfa, network, nist, penetration-testing, phishing, privacy, ransom, ransomware, regulation, resilience, risk, security-incident, service, skills, technology, threat, tool, update, usa, vulnerability, vulnerability-managementThe US Department of Health and Human Services (HHS) has launched a consultation on stricter rules for the safeguarding of electronic health records.The proposed revamp of security rules covered by the Health Insurance Portability and Accountability Act (HIPAA) is designed to address the increased risk from cyberattacks such as ransomware against healthcare environments.The revamped rules…
-
5 Things Government Agencies Need to Know About Zero Trust
Tags: access, application-security, attack, best-practice, business, cloud, control, cyber, cybersecurity, data, gartner, government, identity, incident response, infrastructure, Internet, jobs, monitoring, network, nist, risk, skills, strategy, technology, update, vulnerability, vulnerability-management, zero-trustZero trust as a concept is simple to grasp. Implementing a zero trust architecture, on the other hand, is complex because it involves addressing a unique mix of process, procedure, technology and user education. Here are some considerations to keep in mind as you begin your journey. Draft guidance on implementing a zero trust architecture,…
-
Securing the Quantum Era: What NIST’s New Encryption Standards Mean for Cybersecurity
First seen on scworld.com Jump to article: www.scworld.com/perspective/securing-the-quantum-era-what-nists-new-encryption-standards-mean-for-cybersecurity