NIST SP 800: Information Security Library
I want to introduce habra users, related directly or indirectly to the issues of information protection, with practically remarkable methodical resource not mentioned on Habré: “NIST Special Publications 800 Series” .NIST - National Institute of Standards and Technology - American National Institute of Standardization, an analogue of the national GosStandard. It includes a competent and computer security center in the United States - CSRC , which brings together specialists from federal services, universities, and the largest US IT companies. Since the beginning of the 1990s, the Center has published Standards (FIPS) and more detailed explanations / recommendations (Special Publications) in the field of information security. The Special Publications, created by the CSRC, is assigned the code 800. I propose to talk about them in more detail.
The CSRC has created three working groups that distribute all the activities of the center in major areas:
- information security management;
- technical issues of information security;
- cryptographic protection of information.
Each of the groups has dozens of publications. Due to the fact that cryptography is quite a specific area, recommendations in this area, perhaps, deserve a separate article, and below I will give an overview of the most interesting and popular documents of the first two groups.
')
Many documents are regularly reviewed - the year of issue of the latest version is indicated in parentheses (this explains the non-observance of the order of the numbers of the documents themselves). Documents in bold type are those that are most frequently found / cited in other IB materials in the links.
Information Security Management
The section contains a “gentleman's set” of, perhaps, any stack of standards / recommendations on information security management, but I recall that the status of the CSRC makes them actually strongly recommended for use in all US government agencies, and this is quite a lot of it.
(2003) | Creating an IT security awareness program |
| Areas of responsibility of participants in the process, preparation of the material, possible problems at the stage of program implementation, the control / audit process, examples | |
(2006) | Testing IT security plans |
| Politics, areas of responsibility, methodology, examples of documents, particular methods: “desktop” test, simulations, testing in real situations | |
(2006) | Information Security Summary for Management |
| The process of ensuring information security in organizations, the life cycle of IT systems, security of interaction between IT systems, training / raising awareness of employees in the field of information security, risk management in the field of information security, evaluation, certification, control, continuity and incident management | |
(2008) | Classification of information and information systems for security requirements methodology classifier |
| The method of assignment and the classifier (recommended values) of the levels of the impact of breaches of confidentiality, integrity and availability depending on the type (purpose) of the processed information | |
(2008) | Technical issues of assessing the level of information security |
| Evaluation methods, self-assessment, internal audit, external audit, pentest, process organization, assessment, analysis of results, use of results in the process of improving the organization's information security | |
(2009) | Password Management |
| Existing threats when using password authentication, ensuring the storage of the password database, attacks of social engineering. | |
(2010) | IS Risk Management in Federal Information Systems |
| Detailed methodology for managing the risks of information security, the roles and responsibilities of participants in the process, a description of related documents | |
(2010) | Planning for ensuring continuity in federal information systems |
| Interrelation of various levels of ensuring continuity, assessment of the impact of various types of incidents on the service, choice of strategies, development and testing of plans, basic technologies for ensuring the continuity of information systems and services | |
(2011) | Information Security Monitoring in Federal Information Systems |
| Possible levels of security monitoring: organization in general / business processes / IT systems, development of a monitoring strategy, definition of metrics, analysis of incoming data, use of results in the process of improving the organization's information security | |
(2012) | Information Security Incident Management |
| Planning the process, creating a response team and its operation regulations, detecting incidents, prioritizing, choosing a response strategy, reducing damage, restoring systems, ensuring interaction between the executors in the incident response process | |
(2012) | Security Update Management |
| Issues and problems in the update management process, technology to keep software up to date, process metrics | |
Technical issues of information security
Further, in a shorter format - the most interesting technical publications of CSRC. I will not argue with the fact that among the documents of the CSRC there are also frankly obsolete (I tried to exclude them from the list). However, in general, the IT department of NIST, according to many experts, is one of the most dynamic standards institutes in the field of IT / IB. They try to issue recommendations almost immediately on the fact of significant trends in the emergence of new or redistribution of old threats in the field of information security (the most "tasty", respectively, probably at the bottom).
I hope that in this variety everyone will find a couple of documents for a leisurely reading in the after-holidays!
Source: https://habr.com/ru/post/164371/
All Articles