CISA and NSA Publish Joint Cybersecurity Advisory on Control System Defense

 CISA and the National Security Agency (NSA) have published a joint
cybersecurity advisory about control system defense for operational technology
(OT) and industrial control systems (ICSs). Control System
Defense: Know the Opponent is intended to provide critical infrastructure
owners and operators with an understanding of the tactics, techniques, and
procedures (TTPs) used by malicious cyber actors. This advisory builds on NSA
and CISA 2021 guidance provided to stop
malicious ICS activity against connect OT, and 2020 guidance to reduce
OT exposure.

CISA and NSA encourage critical infrastructure owners and operations to
review the advisory, [Control System Defense: Know the Opponent], and apply the
recommended mitigations and actions. For more information on CISA’s resources
and efforts to improve ICS cybersecurity, visit CISA’s role in industrial control systems webpage.

NIST IoT Cybersecurity Program Releases Two New Documents

 NIST’s Cybersecurity for the Internet of Things (IoT) program has
released two new documents:

The new consumer profile reflects the next steps discussed in the summary report on
the work done on the IoT cybersecurity labelling criteria portion of the work
responding to Executive Order
14028. This profile builds on prior releases and the stakeholder
feedback they generated.

NIST Proposes the Conversion of FIPS 198-1 (HMAC) to a NIST Special Publication

 As a part of the periodic review of NIST’s cryptographic standards
and guidelines, NIST’s Crypto Publication Review Board announced
the review of FIPS 198-1 The
Keyed-Hash Message Authentication Code (HMAC) in August
2021. In response, NIST received public comments.

NIST proposes to convert FIPS 198-1 to a NIST Special Publication
(SP), and apply the following changes:

  • Update the HMAC specification
    to include block sizes for the SHA-3 family of hash functions
  • Include a discussion on
    truncation
  • Improve the editorial quality
    and update references

Conversion to an SP: NIST typically specifies
fundamental cryptographic primitives—block ciphers, digital signatures
algorithms, and hash functions—as FIPS publications, whereas other
cryptographic schemes—modes of operation, message authentication codes,
etc.—are published as a part of the NIST SP 800 series. (For more information,
see Section 3 of NISTIR 7977.)
To be consistent with that approach, NIST proposes to convert FIPS 198-1 to an
SP.

In particular, NIST proposes to develop a draft SP for the HMAC
specification, updated as described above, which would be released for public
comment. When the SP is finalized and published, FIPS 198-1 would be withdrawn
simultaneously.

Send comments on the decision proposal by October 20, 2022 to cryptopubreviewboard@nist.gov
with “Comments on FIPS 198-1 decision proposal” in the subject
line.  


Comments received in response to this request will be posted on the Crypto
Publication Review Project site after the due date. Submitters’
names and affiliations (when provided) will be included, while contact
information will be removed. See the project site for additional information
about the review process.

Read
More

Initial Public Draft of NIST IR 8427 Available for Comment

 The National Institute of Standards and Technology (NIST) has
released the initial public draft of NIST Interagency Report (IR) 8427, Discussion on the Full Entropy Assumption of the SP 800-90
Series. This document is being released at the same time as the
third public draft of NIST Special Publication (SP) 800-90C, Recommendation for Random Bit Generator (RBG) Constructions,
in support of the SP 800-90 series of publications.

The NIST SP 800-90 series supports the generation of high-quality
random bits for cryptographic and non-cryptographic use. The security of a
random number generator depends on the unpredictability of its outputs, which
can be measured in terms of entropy. The NIST SP 800-90 series uses min-entropy
to measure entropy. A full-entropy bitstring has an amount of entropy equal to
its length. Full-entropy bitstrings are important for cryptographic
applications, as these bitstrings have ideal randomness properties and may be
used for any cryptographic purpose. Due to the difficulty of generating and
testing full-entropy bitstrings, the SP 800-90 series assumes that a bitstring
has full entropy if the amount of entropy per bit is at least 1 – ε, where ε is
at most 2-32. NIST IR 8427 provides a justification for the
selection of ε.

The public comment period for NIST IR 8427 is open through October
31, 2022. See the publication
details for a copy of the draft and instructions for submitting
comments.

Read
More

Request for Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process

The Post-Quantum Cryptography (PQC) standardization process is
continuing into a fourth round with the following key-encapsulation mechanisms
(KEMs) still under consideration: BIKE, Classic McEliece, HQC, and SIKE.
However, there are no remaining digital signature candidates under
consideration. As such, NIST
is requesting additional digital signature proposals to be considered in the
PQC standardization process.

NIST is primarily interested in additional general-purpose
signature schemes that are not based on structured lattices. For certain
applications, such as certificate transparency, NIST may also be interested in
signature schemes that have short signatures and fast verification. NIST is
open to receiving additional submissions based on structured lattices but is
intent on diversifying the post-quantum signature standards.  As such, any
structured lattice-based signature proposal needs to significantly outperform
CRYSTALS-Dilithium and FALCON in relevant applications and ensure substantial
security properties in order to be considered for standardization.

Complete instructions on how to submit a candidate package,
including the minimal acceptability requirements, are posted on the PQC: Digital Signature Schemes project page.
The finalized evaluation criteria that will be used to assess the submissions
are also posted at the same website. Submission
packages must be received by NIST by June 1, 2023.

Read
More

Submit Comments on FIPS 180-4

 NIST is in the process of a periodic review and maintenance of its
cryptography standards and guidelines.   

This announcement initiates the review of Federal Information Processing
Standard (FIPS) 180-4, Secure Hash
Standard (SHS), 2015.

NIST requests public
comments on all aspects of FIPS 180-4. Additionally, NIST would
appreciate feedback on the following two areas of particular concern:

  1. SHA-1. In recent years, the cryptanalytic attacks on the SHA-1
    hash function have become increasingly severe and practical (see, e.g., the 2020
    paper “SHA-1 is a Shambles” by Leurent and Peyrin    ).
    NIST, therefore, plans to remove SHA-1 from a revision of FIPS 180-4 and
    to deprecate and eventually disallow all uses of SHA-1. The Cryptographic
    Module Validation Program     will establish a validation
    transition schedule.

*  How will this
plan impact fielded and planned SHA-1 implementations?
*  What should NIST consider in establishing the timeline for disallowing
SHA-1?

  1. Interface. The “Init, Update, Final” interface was part
    of the SHA-3 Competition submission requirements. Should a revision of
    FIPS 180-4 discuss the “Init, Update, Final” hash function interface?

 The public comment period is open through September 9, 2022. Comments
may address the concerns raised in this announcement or other issues around
security, implementation, clarity, risk, or relevance to current
applications.  

Send comments to cryptopubreviewboard@nist.gov with
“Comments on FIPS 180-4” in the Subject. 

For more information about the review process, visit the Crypto
Publication Review Project page. 

Read
More

Microsoft has The Chief Information Security Officer (CISO) Workshop Training

 The Chief Information Security Office (CISO) workshop helps accelerate security program modernization with reference strategies built using Zero Trust principles.

The workshop covers all aspects of a comprehensive security program including strategic initiatives, roles and responsibilities, success metrics, maturity models, and more. Videos and slides can be found here.

This is free training

To learn more go here

Microsoft Exam Readiness Zone

This is a great resource for those pursuing Microsoft certification.

Join our experts as they provide tips, tricks, and strategies for preparing for a Microsoft Certification exam. Our exam prep videos will help you identify the key knowledge and skills measured on the exam and how to allocate your study time. Each video segment corresponds to a major topic area on the exam. Our trainer will point out objectives that many test takers find difficult. In these videos, we include example questions and answers with explanations. We recommend that you watch these videos after you have completed training or had some practice. However, you can watch them at any point in your certification journey. We also provide additional exam preparation resources

 

Exam Readiness Zone | Microsoft Docs