Blog

Blog
October 12, 2017

The National Cybersecurity Center of Excellence (NCCoE) is excited to announce the release of three new draft project descriptions: TLS (Transport Layer Security) Server Certificate ManagementIoT-Based Automated Distributed Threats, and Privileged Account Management: Securing Privileged Accounts for the Financial Services Sector. We are seeking your feedback on these drafts to help refine the challenge and scope.

Blog
August 31, 2017  |  Susan Prince

In collaboration with the financial services community and technology collaborators, the National Cybersecurity Center of Excellence (NCCoE) developed draft cybersecurity guidance, NIST Special Publication 1800-9: Access Rights Management for the Financial Services Sector, which uses standards-based, commercially available technologies and industry best practices to help financial services companies provide a more secure and efficient way to manage access to data and system. The draft guide is now open for public comment through October 31, 2017.

Blog
August 23, 2017  |  Caroline Tan, NCCoE Summer Intern

I learned that the concept of managing each transfer in a supply chain can be applied to the outputs of any company or organization. That basic understanding of product movement in planning, procurement, manufacturing, and delivery helped me transition into my internship at the National Institute of Standards and Technology’s (NIST) National Cybersecurity Center of Excellence (NCCoE). I was initially intimidated by the name and intellectual weight of the organization. These innovators—my now co-workers—were spearheading cybersecurity solutions for wireless infusion pumps, secure inter-domain routing, and identity and access management. And they even shed light on supply chain management, explaining to me that there is a possibility of risk at each transfer point and at each step in the process, not just with physical materials, but also with the critical intangibles such as data, software, and intellectual property. Here, I found an overlap that wasn’t deeply addressed in my supply chain course. I wanted to combine my undergraduate background and experience with the wealth of knowledge around me and contribute back to the organization.

Blog
August 08, 2017  |  Sarah Kinling

Callsign, CA Technologies, Rivetz, RSA, Splunk, StrongAuth, TokenOne, and Yubico, have joined the National Cybersecurity Center of Excellence (NCCoE) as technology collaborators in the Multifactor Authentication (MFA) for e-Commerce project.* In response to a call in the Federal Register, these companies submitted capabiliti

Blog
June 27, 2017  |  Donna Dodson

As its name suggests, the internet of things will connect all kinds of things, bringing us a wealth of data about, well, everything that we can use to improve our lives. For example, internet-connected smart parking meters are helping people find available parking spaces, saving time, fuel and probably more than a few relationships. People are using fitness trackers to log their daily activity and achieve their fitness goals, making them healthier and happier. And technologies that promise to make travel safer and more convenient, such as self-driving cars and highway sensors that detect and adapt to real-time road conditions, are quickly moving from concept to reality.

Blog
May 24, 2017  |  William Fisher

Motorola Solutions, Nok Nok Labs, Ping Identity, StrongAuth, and Yubico have joined the National Cybersecurity Center of Excellence (NCCoE) as technology collaborators in the Mobile Application Single Sign-On (SSO) project. As part of this collaboration, NIST will compose and release a publicly available Cybersecurity Practice Guide (Special Publication 1800 series) that will document the reference design and help public safety and first responder (PSFR) organizations implement multifactor authentication and mobile application SSO in their own environments.

Blog
May 05, 2017

As the world rapidly embraces the Internet of Things, properly securing medical devices has grown challenging for most healthcare delivery organizations (HDOs). That’s because medical devices, such as infusion pumps, have evolved from standalone instruments that interacted only with the patient and a medical provider into devices that now connect wirelessly to a variety of systems, networks, and other platforms to enhance patient care, as part of the broader Internet of Medical Things (IoMT). As a result, cybersecurity risks have risen. Wireless infusion pump ecosystems, which include the pump, the network, and the data stored in and on a pump, face a range of potential threats, such as unauthorized access to protected health information (PHI), changes to prescribed drug doses, and interference with a pump’s intended function.

In collaboration with the healthcare community and manufacturers, the NCCoE developed cybersecurity guidance, draft NIST Special Publication 1800-8: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations, which uses standards-based, commercially available technologies and industry best practices to help HDOs strengthen the security of wireless infusion pumps within healthcare facilities. The draft guide is now open for public comment.  

Blog
March 07, 2017  |  Joshua M. Franklin and Christopher Brown

The 2017 RSA Conference offered great opportunities, as usual, for the NCCoE staff to learn from the cyber community and engage with industry. The conference supported an entire track of mobile security talks, and common themes included the intersection of mobile security/IoT, and the (lack) of privacy within mobile ecosystems. As the NCCoE continues its work in mobile device security, we were excited to see mobile security gaining more traction at the RSA Conference.

Blog
February 16, 2017  |  NIST

As part of their current cybersecurity efforts, many electric utilities monitor data from the various systems and devices they rely on to keep the power flowing and to secure both their information technology and facilities. Pulling these data together and correlating events across data streams can be a time-consuming process, so the National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology collaborated with a team of experts from industry, academia and government to develop a guide utilities can use to improve situational awareness and better respond to potential cyber attacks.

Blog
February 09, 2017  |  Sarah Kinling

The National Cybersecurity Center of Excellence (NCCoE), a part of the National Institute for Standards and Technology (NIST), will demonstrate its current projects in San Francisco Feb. 13-17 at the RSA Conference and Orlando Feb 19-23 at the Healthcare Information and Management Systems Society Annual Conference & Exhibition (HIMSS17).