blogmirnet – Page 26 – My information Resource (blog.mir.net)

Get the most from AI with new data and analytics best practices

Join us at Configure Security Operations Using Microsoft Sentinel training day

Microsoft Security Virtual Training Day: Configure Security Operations Using Microsoft Sentinel

Strengthen your Zero Trust posture with a unified approach

NEW BLOG | Protecting Trained Models in Privacy-Preserving Federated Learning

This post is part of a series on privacy-preserving federated learning. The series is a collaboration between NIST and the UK government’s Responsible Technology Adoption Unit (RTA), previously known as the Centre for Data Ethics and Innovation.

The last two posts in our series covered techniques for input privacy in privacy-preserving federated learning in the context of horizontally and vertically partitioned data. To build a complete privacy-preserving federated learning system, these techniques must be combined with an approach for output privacy, which limit how much can be learned about individuals in the training data after the model has been trained.

As described in the second part of our post on privacy attacks in federated learning, trained models can leak significant information about their training data—including whole images and text snippets.

Training with Differential Privacy

The strongest known form of output privacy is differential privacy. Differential privacy is…

Read the Blog

Personal Identity Verification (PIV) Interfaces, Cryptographic Algorithms, and Key Sizes: NIST Revises SP 800-73 and SP 800-78

In January 2022, NIST revised Federal Information Processing Standard (FIPS) 201, which establishes standards for the use of Personal Identity Verification (PIV) credentials, including those on PIV Cards. NIST Special Publication (SP) 800-73-5: Parts 1–3 and SP 800-78-5 have subsequently been revised to align with FIPS 201.

SP 800-73-5: Parts 1–3
SP 800-73-5: Parts 1–3, Interfaces for Personal Identity Verification, describe the technical specifications for using PIV Cards. The three parts cover the PIV data model (Part 1), the card edge interface (Part 2), and the application programming interface (Part 3). Major changes to the documents include:

Removal of the previously deprecated CHUID authentication mechanism
Deprecation of the SYM-CAK and VIS authentication mechanisms
Addition of an optional 1-factor secure messaging authentication mechanism (SM-Auth) for facility access applications
Additional use of the facial image biometric for general authentication via BIO and BIO-A authentication mechanisms
Addition of an optional Cardholder identifier in the PIV Authentication Certificate to identify a PIV credential holder to their PIV credential set issued during PIV eligibility
Restriction on the number of consecutive activation retries for each of the activation methods (i.e., PIN and OCC attempts) to be 10 or less
SP 800-73-5: Part 3 on PIV Middleware specification marked as optional to implement

SP 800-78-5
SP 800-78-5, Cryptographic Algorithms and Key Sizes for Personal Identity Verification, defines the requirements for the cryptographic capability of the PIV Card and supporting systems in coordination with FIPS 201-3. It has been modified to add additional algorithm and key size requirements and to update the requirements for Cryptographic Algorithm Validation Program (CAVP) validation testing, including:

Deprecation of 3TDEA algorithms with identifier ‘00’ and ‘03’
Removal of the retired RNG from CAVP PIV component testing where applicable
Removal of retired FIPS 186-2 key generation from CAVP PIV component testing where applicable
Accommodation of the Secure Messaging Authentication key
Update to Section 3.1 and Table 1 to reflect additional higher strength keys with at least 128-bit security for use in authentication beginning in 2031

New Privacy-Preserving Federated Learning Blog Post

Dear Colleagues,

ln the last two posts of our Privacy-Preserving Federated Learning (PPFL) blog series, we covered techniques for input privacy in PPFL in the context of horizontally and vertically partitioned data. However, to complete a PPFL system, these techniques must be combined with an approach for output privacy to limit what can be inferred about individuals after model training. Want to learn more about output privacy and training with differential privacy? Found out more in this new post, Protecting Trained Models in Privacy-Preserving Federated Learning!

Protecting Trained Models in Privacy-Preserving Federated Learning by Joseph Near and David Darais
Read the post.

Read blogs #1 – #6 on our PPFL Blog Series page. We encourage readers to ask questions by contacting us at privacyeng@nist.gov.

Meanwhile—stay tuned for the next PPFL blog post!

All the best,
NIST Privacy Engineering Program

Register for the Next NIST Small Business Cybersecurity Webinar: Ransomware Prevention, Detection, Response, and Recovery

Event Date: August 15, 2024

Event Time: 2:00PM – 3:00PM EDT

Event Location: Virtual

Description:

Ransomware is a very serious and increasingly common threat to organizations of all sizes, and it is particularly devastating to smaller organizations that have limited resources. A successful ransomware attack can stop your business in its tracks.

During this NIST small business cybersecurity webinar, we will convene a panel to highlight:

Common ways ransomware is delivered to businesses.
Challenges small businesses face with ransomware.
Common signs of a ransomware attack.
What steps to take if your business falls victim to a ransomware attack.
What role cyber liability insurance plays in ransomware risk management.
Steps small businesses can take, and free resources you can use, to reduce your likelihood of falling victim to ransomware.

Panelists:

Bill Fisher, Security Engineer, NIST
Nick Lozano, Director of Technology, The Council of Insurance Agents & Brokers
Stephanie Walker, Assistant Section Chief of the Cyber Engagement and Intelligence Section, Federal Bureau of Investigation (FBI)
Ann Westerheim, Ph.D. Founder and President, Ekaru

Moderator:

Daniel Eliot, Lead for Small Business Engagement, NIST

NIST Workshop on Privacy-Enhancing Cryptography 2024

What: NIST Workshop on Privacy-Enhancing Cryptography (WPEC) 2024
Date & time: September 24–26, 10am–5pm (EDT)
Featured topics: Private-Set Intersection; other Privacy-Enhancing Cryptography (PEC) tools (MPC, FHE, ZKP, …)
Free registration: ZoomGov Event
Talk proposals: Check the Call for Talks and the Submission Form (July 22nd deadline)
Details and updates: Check the WPEC 2024 webpage
Tweet: https://twitter.com/NISTcyber/status/1802806825747882138
Organizing project: NIST Privacy-Enhancing Cryptography (PEC)
PEC-Forum: For future related announcements, join the “PEC-forum” mailing list

WPEC 2024, the NIST Workshop on Privacy-Enhancing Cryptography 2024, will bring together multiple perspectives of PEC stakeholders. The three-day virtual workshop is organized for sharing insights about PEC capabilities, use cases, real-world deployment, initiatives, challenges and opportunities, and the related context of privacy and auditability. The program will cover the following two themes:

Private Set Intersection (PSI): for a deep dive into this specific technique, exploring its technicalities, readiness, feasibility, applicability, variants, and broader context.
Other PEC techniques: Other PEC techniques: for a broader perspective of PEC (including FHE, MPC, and ZKP, and possible combinations with other privacy-enhancing technologies).

AT&T Discloses Breach of Customer Data

On July 12, AT&T released a public statement on unauthorized access of customer data from a third-party cloud platform. AT&T also provided recommendations and resources for affected customers.

CISA encourages customers to review the following AT&T article for additional information and follow necessary guidance to help protect personal information.

AT&T: Unlawful access of customer data

Author: blogmirnet