Cit

Director, Information Technology 

Octob
` The U.S. economy and U.S. citizens are heavi

information technology (IT)

◦ No sector today could function without IT◦ Energy, supply chain, finance, ecommerce, transporta

` Although considerable progress has been ma

cybersecurity capabilities to protect IT, there be done

◦ Determine how to mitigate new threats and secure ne

` Cybersecurity needs to become more standa

further improve quality and efficiency. Cyberneeds to become easier for people to adopt a

◦ These changes would significantly reduce the cost of 

implementation and management, as well as the econcybersecurity incidents

2
` Administration Priorities

◦ Comprehensive National Cybersecurity Initiative (HSP

January 2008

◦ President Obama, May 2009, regarding the nation’s c

“Protecting this infrastructure will be a national securensure that these networks are secure, trustworthy andeter, prevent, detect, and defend against attacks anfrom any disruptions or damage.”

◦ Cyberspace Policy Review, May 2009: “The global cha

cyberspace requires an increased effort in multilaterashould seek—in continued collaboration with the privimprove the security of interoperable networks throuof global standards....”

◦ Science and Technology Priorities for the FY2011 Bud

◦ “Improving and protecting our information, communicatio

infrastructure, which is essential to our commerce science

` Congressional Initiatives

◦ Federal Information Security Management Act of 200◦ Draft Cybersecurity Act of 2009 and other draft legis

3
National and International 

Standards Bodies

Federal Go

4

Other Gove- CIO Counc- Informatio

Managem

- Standards 

Assessme

Industry Organizations- Smart Card Alliance- Security Industry Association- International Biometrics Industry Assoc.- IPv6 Forum Key Industry Players

‒ Apple‒ EMC2‒ Microsoft‒ Oracle ‒ Red Hat
` Biometrics

◦ USA PATRIOT Act◦ Enhanced Border Security and Visa Entry Reform Act◦ Homeland Security Presidential Directive #12: Policy for a Common Identifica

and contractors

◦ 10-Print Transition: mandated by Homeland Security Council Deputies Comm◦ National Security Presidential Directive #59/ Homeland Security Presidential D

Identification and Screening to Enhance National Security.

` Cybersecurity

◦ Federal Information Security Management Act (FISMA) of 2002 (Title III of the 

x Information Security and Privacy Advisory Board (ISPAB) mandate amended

◦ Computer Security Research and Development Act of 2002◦ Homeland Security Presidential Directive #12◦ Homeland Security Presidential Directive #7: Critical Infrastructure Identificat◦ Conference Report on House Resolution 5441, Department of Homeland Secu

- General Provisions (WHTI Certification effort)

◦ OMB M04-04 E-Authentication Guidance for Federal Agencies

◦ Information Technology Management Reform Act of 1996, Public Law 104-10◦ OMB Circular A-130 and OMB Directive 05-24 

` Healthcare

◦ American Recovery and Reinvestment Act

` Internet Protocol version 6 (IPv6)

◦ OMB memo M-05-22 on Transition Planning for IPv6 (August 2, 2005) 

` Voluntary Voting System Standards

◦ Help America Vote Act

5
` Provides the objectivity and neutrality that ar

◦ Objectivity—standards are based on scientific researc◦ Neutrality—standards are not designed to benefit one 

industry over the economic interests of another

◦ Openness—standards undergo a comprehensive pub

to publication

` Technical source of cybersecurity expertise f` Long history of cooperation with U.S. industr

development of standards

` Public and industry “buy-in” to foster widesp

implementation

` Collaborative access to international cyberse

industry, academia, and standards organizat

` National perspective vs. community-specific ` NIST mandated to develop cybersecurity stan

6
` NIST is obligated by statute to develop standar

coordinate with other agencies

◦ HSPD-12, 2004: Dept. of Commerce required to develop 

secure and reliable forms of identification”

◦ FISMA, 2002: NIST responsible “for developing standards 

cybersecurity

◦ OMB Circular A-130, 2002: “The Department of Commer

assigned the responsibility to develop and issue security guidelines...”

◦ Computer Security Act, 1987: NIST responsible for develo

guidelines for Federal computer systems

` NIST supports cybersecurity standards in sever

◦ Develop and revise standards◦ Evaluate candidates for a standard◦ Coordinate other standards efforts◦ Establish validation programs to confirm standards imple◦ Provide guidance to agencies on how to use standards an

technologies

◦ Actively submit NIST-developed standards to national an

standards organizations to provide a base for harmoniza

7
` FISMA Implementation Project

◦ Federal Information Processing Standard (FIPS) 199 a

200 are standards that specify minimum security requirements for Federal information and information 

◦ Ongoing research and outreach efforts to keep SP 80

which contains the detailed requirements, up-to-date

` Federal Desktop Core Configuration (FDCC)

◦ Standardized security configurations for operating sy

and automated tools to test the configurations, improsecurity and saving IT security management resource

◦ Implemented on millions of Federal desktop and lapt

computers

` Internet Protocol Version 6 (IPv6)

◦ Providing test and measurement tools for hardening 

Internet protocols: Standards, deployment, and testinInternet Protocol (IPv6)

◦ Published the U.S. Government IPv6 Profile, and deve

strategies for conformance and interoperability testin

8
` Seamless and Secure Mobility

◦ Standards and tools to provide users with ubiquitous 

connectivity and the ability to roam seamlessly and sacross networks of different types 

◦ Collaborating on IEEE 802.21 Media Independent Han

standards, IETF mobility optimization specification

` Computer Forensics Tool Testing (CFTT) Proj

◦ Provides metrics of assurance that the tools used by 

enforcement in the investigations of computer-relateproduce valid results

◦ Develop specifications for tools and establish testing 

methodology

` National Software Reference Library

◦ Provides a repository of known software, file profiles, 

signatures for use by law enforcement and other orgain computer forensics investigations

◦ Published quarterly as Standards Reference Data: NIS

Database 28

9
` Usability of Security

◦ Performing groundwork research to define factors tha

enable usability in the area of multifactor authenticatand developing a framework for determining metrics are critical to the success of usability

` Usability of Biometric Systems

◦ Standardize and improve usability of user interfaces o

biometric systems to enhance performance and user satisfaction

◦ Developing a methodology and guidelines for capturi

user requirements and transforming them into a desiappropriate for small platforms

` Identity Management Systems

◦ Standards development work in biometrics, smart car

identity management, and privacy framework. 

◦ R&D: Personal Identity Verification, Match-On-Card, 

ontology for identity credentials, development of a workbench

◦ ID Credential Interoperability

10
` Software Assurance Metrics and Tool 

Evaluation (SAMATE)

◦ Providing metrics to assess the validity of tools and 

techniques used for software assurance, leads to improved tools and provides assurance to users of the benefits of the tools

◦ Open Web Application Security Project developing a 

common software flaw taxonomy, the Common Weakness Enumeration

` Voting security

◦ Foster the development of voluntary consensus 

guidelines on implementing election-related technologies

◦ Establish accreditation program for voting system 

testing

11
` Smart grid security

◦ Coordinate development of cybersecurity elements of 

framework of protocols and model standards; contincoordinated with networking standards and guidance

◦ Selecting use cases from existing sources, e.g., Intell

Electric Power Research Institute (EPRI), and Southern California Edison (SCE)

◦ Use cases provide a common framework for performi

risk assessment, developing the security architectureselecting and tailoring the security requirements

` Healthcare information technology

◦ NIST provides security specifications for enabling 

communicating parties to transmit health information securely and to ensure privacy and confidentiality

◦ Developing guidelines for HIPAA Security Rule and Se

Architecture Design Process for Health Information Exchanges

◦ Leveraging prior cybersecurity efforts

12
` Quantum Communications

◦ Demonstrate and test secure, commercial-grade 

communication components, systems and protocols the quantum era

` Foundations of Measurement Science for 

Information Systems 

◦ Large-scale systems (e.g., the Internet, power grid) 

deployed without fundamental understanding of theirange of behaviors, security; Information systems lacsame foundations as physical sciences

◦ Basic research program: mathematical foundations 

underlying development of a measurement science foinformation systems; Initial Focus: Abstract models oinformation systems structure, dynamics

13
` Advanced Encryption Standard (AES)

◦ Protects sensitive data being stored or transmitted◦ Adopted voluntarily by national and international stan

◦ Incorporated at minimum cost and without royalty fe

` Domain Name System Security Extensions (D

◦ Collaboration with IETF on standardizing security ext◦ Foster DNSSEC deployment in government and root d

` Multifactor Authentication

◦ Developing standards for biometrics, smart card inte

authentication

◦ Working with vendors, other federal agencies, and th

community

14
` Continue ongoing standards developmen

` Technical leadership and coordination in 

standards efforts

◦ Cryptographic Hash Competition◦ Smart Grid standards◦ Health IT standards◦ Voting standards

` Establish validation programs

◦ Product/service evaluation/validation programs

` Perform R&D to create technical specifica

possible future adoption as standards

◦ Security Content Automation Protocol (SCAP)◦ Policy Machine

15

17
Current Organizational Structure

Information Technology Laboratory

Director

Office of the Associate Director for 

Federal and Industrial Relations

Office of the Assistant Director for Boulder Deputy Dir

Executive O

Complex Systems

Cyber and Network Security

Mathematical an

Computational Scie

Advanced Netwo

Technologies

Computer Securi

Information Acce

Software and Syste

Statistical Enginee

Office of the Associate Director for 

Program Implementation

Office of Programs

Virtual Measurements

Chief Cybersecur

Enabling Scientific Discovery

Identity Management

Information Discovery, Use and Sharing

Pervasive Information Technology

Trustworthy Information Systems
Computing and Mathematical Sciences Labo

Director

Office of the Associ

Federal and Indus

Office of the 

Director for 

Deputy D

Applied & C

Mathemat

Informatics 

Metrolog

Network 

Science

Core Co

Technolog

Statistical Eng

Office of the Associate Director for 

Cybersecurity Research and Development

Complex Systems

Cyber and Network Security

Information Discovery, Use and Sharing

Enabling Scientific Discovery

Pervasive Information Technology

Virtual Measurements

Identity Management

Trustworthy Software

Office of the Associate Director for 

Program Implementation

Updated 8/17/2009

Executive 

Complex Systems

Information Discovery, Use and Sharing

Enabling Scientific Discovery

Pervasive Information Technology

Virtual Measurements

Draft Proposed Organizational Structu