ITL Workshops on Statistical 

Interpretation of DNA Mixtures 

Bring About Procedural 

Changes at Texas DNA 

Laboratories

Cybersecurity Framework 

Update

Pilot Funding for Accessing 

Online Health Information 

Consumer-Facing/Retail Sector 

Cybersecurity Workshop

Annual FISSEA Conference 

Focuses on the Power of 

Cybersecurity Training and 

Awareness

Staff Accomplishments

Selected New Publications

Upcoming Technical 

Conferences

ITL Workshops on Statistical Interpretation of DNA 

Mixtures Bring About Procedural Changes at Texas 

DNA Laboratories

In 2015, the Texas Forensic Science Commission raised concerns about how forensic evidence 

was being interpreted by forensic laboratories in Texas. These concerns included interpretation 

methods of DNA mixtures. The common practice had been to assign the probability that a random 

person in the population is included as a possible contributor to the mixture, using a protocol that 

was not adapted to the complex, low-template DNA mixtures recovered from crime scenes today. 

In response to these concerns DNA laboratories in Texas are changing their approach from an 

inclusion probability to a much more powerful and adaptable likelihood ratio method. To facilitate 

this, staff from ITL’s Statistical Engineering Division conducted the workshops in DNA mixture 

interpretation in Texas. 

All of the DNA laboratories in Texas are now transitioning towards a continuous model for assigning 

likelihood ratios for the interpretation of DNA evidence. This is the most advanced approach that 

currently exists because it makes the most use of the information present in the electropherograms 

obtained from the DNA analyses. To help the laboratories with this transition, ITL guest researcher 

John Buckleton and statistician Simone Gittelson gave parts of a two-day workshop in November 

2015 to all of the technical leaders of the forensic DNA laboratories in Texas. This workshop was 

held in Fort Worth and given in collaboration with Prof. Bruce Budowle, Director of the Institute of 

Applied Genetics at the University of North Texas Health Science Center. Simone Gittelson then 

followed up by travelling to Texas for two weeks in January 2016 to give three two-day workshops 

to three groups of DNA analysts of the Texas Department of Public Safety: the first took place in 

Austin, the second in Houston, and the third in Fort Worth. All of these workshops consisted of 

interactive presentations and practical exercises on mixture deconvolution, assigning the number of 

contributors, probability theory, match probabilities, and likelihood ratios. At each of the workshops, 

there were between 40 and 50 participants. 

The first case using this approach starts April 18, 2016, with some high-profile death penalty cases 

in the pipeline. ITL will follow the results of their DNA workshop efforts with interest.

Credit: ASU Biodesign Institute 
Cybersecurity Framework Update

On April 6-7, 2016, ITL hosted a Cybersecurity Framework 

Workshop at NIST. Since Version 1.0 of the Cybersecurity 

Framework (Framework) was released on February 12, 

2014, ITL has been working to raise awareness of the 

Framework and encourage its use as a tool to help industry 

sectors and organizations manage cybersecurity risks. The 

workshop served as a progress touchpoint to highlight a 

variety of Framework uses and work products. Nearly 900 

attendees helped ITL to better understand stakeholder 

awareness, current use of the Framework, the need for 

updates, sharing of best practices, and future governance. 

See the website for more information. 

Pilot Funding for Accessing Online 

Health Information 

ITL’s National Strategy for Trusted Identities in Cyberspace 

(NSTIC) National Program Office (NPO) recently 

announced a second solicitation for pilot funding in 2016, 

which focuses on streamlining the way that patients and 

providers access health information from different 

organizations online. The NPO is looking for a project that 

will demonstrate how deployment of federated identity 

credentials improves access to online health information. 

Using the same credential across multiple healthcare 

providers can make life easier for users by simplifying and 

speeding up sign-in processes. For providers, making 

strides in the efficiency of medical record access means 

time and money saved better outcomes for security and 

privacy. The deadline to apply is June 1, 2016. See the 

NSTIC Notes blog for more information.

Consumer-Facing/Retail Sector 

Cybersecurity Workshop

ITL’s National Cybersecurity Center of Excellence (NCCoE) 

recently hosted a public workshop to help consumer-facing 

businesses improve the security around their payment 

ecosystem and better protect consumer information. Held 

at the University of Alabama at Birmingham, the event 

featured keynote speaker Brian Engle, Executive Director 

of the Retail Cyber Intelligence Sharing Center (R-CISC), 

who highlighted current and emerging cybersecurity 

challenges for the retail and consumer-facing sector. An 

interactive panel discussion gave perspectives from across 

the consumer payment ecosystem, and breakout sessions 

looked into technical aspects and architectures, ensuring 

that any future NCCoE projects properly represent 

consumer-facing businesses and their challenges. See the 

website.

Annual FISSEA Conference Focuses 

on the Power of Cybersecurity Training 

and Awareness

On March 15-16, 2016, ITL hosted the 29th Annual Federal 

Information Systems Security Educators’ Association 

(FISSEA) Conference. The FISSEA audience included 

managers responsible for information systems security 

awareness, training, certifications, workforce identification, 

and compliance in federal agencies, contractors providing 

awareness and training support, and faculty members of 

accredited educational institutions who are involved in 

information security training and education. Over 280 

cybersecurity training professionals attended the 

conference. 

The theme for the conference was “The Quest for the 

Unhackable Human: The Power of Cybersecurity 

Awareness and Training.” Reuben Paul, the 10-year-old 

Founder/CEO of CyberShaolin and Prudent Games 

provided an inspiring keynote presentation on R U 

#Unhackable? Presenters represented federal agencies, 

private industry, and academia. 

The FISSEA conference continues to be a valuable forum 

for individuals from government, industry, and academia 

who are involved with information systems/cybersecurity 

awareness, training, education, certification, and 

professionalization to learn of ongoing and planned training 

and education programs and initiatives. It affords ITL the 

opportunity to provide assistance to federal agencies as 

they work to meet their Federal Information Security 

Management Act (FISMA) responsibilities. See the FISSEA 

website.

Staff Accomplishments

John Messina, Software and 

Systems Division, received a 

Technical Achievement Award 

from the InterNational Committee 

for Information Technology 

Standards (INCITS). The award 

recognizes his technical savvy, 

initiative, and international 

leadership in support of the 

INCITS/DAPS38 - Distributed 

Application Platforms & Services 

standards community. 

2
Selected New Publications

Secure Virtual Network Configuration for Virtual Machine 

(VM) Protection

By Ramaswamy Chandramouli

NIST Special Publication 800-125B

March 2016

Virtual Machines (VMs) are key resources to be protected since 

they are the compute engines hosting mission-critical 

applications. Since VMs are end-nodes of a virtual network, the 

configuration of the virtual network forms an important element in 

the security of VMs and their hosted applications. The virtual 

network configuration areas discussed in this documentation are 

network segmentation, network path redundancy, firewall 

deployment architecture, and VM traffic monitoring. Various 

configuration options under these areas are analyzed for their 

advantages and disadvantages and security recommendations 

are provided.

Security Content Automation Protocol (SCAP) Version 1.2 

Validation Program Test Requirements

By Melanie Cook, Stephen Quinn, David Waltermire, and Dragos 

Prisaca

NISTIR 7511 Rev 4

January 2016

This report defines the requirements and associated test 

procedures necessary for products or modules to achieve one or 

more Security Content Automation Protocol (SCAP) validations. 

Validation is awarded based on a defined set of SCAP 

capabilities by independent laboratories that have been 

accredited for SCAP testing by the NIST National Voluntary 

Laboratory Accreditation Program (NVLAP).

NIST Cryptographic Standards and Guidelines Development 

Process

By Cryptographic Technology Group

NISTIR 7977

March 2016

This document describes the principles, processes, and 

procedures that drive cryptographic standards and guidelines 

development efforts at NIST. Reflecting public comments 

received on earlier versions, this document will serve as the basis 

to guide NIST’s future cryptographic standards and guidelines 

development efforts.

NSTIC Pilots: Catalyzing the Identity Ecosystem [including 

updates as of 09-20-2015]

By Katerina Megas, Phil Lam, Ellen Nadeau, and Colin Soutar

NISTIR 8054

March 2016

Pilots are an integral part of the National Strategy for Trusted 

Identities in Cyberspace (NSTIC), issued by the White House in 

2011 to encourage enhanced security, privacy, interoperability, 

and ease of use for online transactions. This document details 

summaries and outcomes of NSTIC pilots and explores common 

themes in the pilots’ work developing and operating innovative 

identity solutions.

Derived Personal Identity Verification (PIV) Credentials (DPC) 

Proof of Concept Research

By Michael Bartock, Jeffrey Cichonski, Murugiah Souppaya, Paul 

Fox, Mike Miller, Ryan Holley, and Karen Scarfone

NISTIR 8055

January 2016

This report documents proof of concept research for Derived 

Personal Identity Verification (PIV) Credentials. Smart card-based 

PIV Cards cannot be readily used with most mobile devices, such 

as smartphones and tablets, but Derived PIV Credentials (DPCs) 

can be used instead to PIV-enable these devices and provide 

multifactor authentication for mobile device users. This report 

captures existing requirements related to DPCs, proposes an 

architecture that supports these requirements, and demonstrates 

how such an architecture could be implemented and operated.

A Rational Foundation for Software Metrology

By David Flater, Paul E. Black, Elizabeth Fong, Raghu Kacker, 

Vadim Okun, Stephen Wood, and D. Richard Kuhn

NISTIR 8108

January 2016

In this report, we revisit software metrology from two directions: 

first, top down, to establish a theory of software measurement; 

second, bottom up, to identify specific purposes for which 

software measurements are needed, quantifiable properties of 

software, relevant units, and objects of measurement. Although 

there are structural obstacles to realizing the vision of software 

metrology that works like physical metrology for all desired 

measurands, progress is possible if we start with a rational 

foundation.

Tattoo Recognition Technology – Best Practices (Tatt-BP): 

Guidelines for Tattoo Image Collection

By Mei Ngan, George W. Quinn, and Patrick Grother

NISTIR 8109

February 2016

This document provides best practice guidelines for the collection 

of good quality tattoo images. As an outcome of the Tatt-C 2015 

activity, algorithm failure to correctly match a tattoo is often 

related to the consistency and quality of image capture. Notably, 

inconsistencies in image angle, orientation, size of the tattoo 

relative to the entire image, and poor collection characteristics 

such as poor illumination, low contrast, blur, and the existence of 

clothing and background clutter caused failures for tattoo 

detection and matching algorithms. While some problems can 

potentially be rectified via post-capture image processing, certain 

properties cannot be recovered after the photograph is taken. As 

such, certain guidelines should be followed to ensure that good 

quality images are collected.

3
The Information Technology Laboratory (ITL) is a major research component of the National Institute of 

Standards and Technology (NIST). As a world-class measurement and testing laboratory encompassing a wide 

range of areas of computer science, mathematics, statistics, and systems engineering, our research program 

supports NIST’s mission to promote U.S. innovation and industrial competitiveness by advancing measurement 

science, standards, and technology in ways that enhance economic security and improve our quality of life. ITL 

cybersecurity experts collaborate to develop cybersecurity standards, guidelines, and associated methods and 

techniques for federal agencies and industry. Our mathematicians and statisticians collaborate with 

measurement scientists across NIST to help ensure that NIST maintains and delivers the world’s leading 

measurement capability. ITL computer scientists and other research staff provide technical expertise and 

development that underpins national priorities such as cloud computing, the Smart Grid, homeland security, 

information technology for improved healthcare, and electronic voting. We invite you to learn more about 

how ITL is enabling the future of the nation’s measurement and standards infrastructure for information 

technology by visiting our website at http://www.itl.nist.gov.

ITL Editor: Elizabeth B. Lennon

National Institute of Standards and Technology

100 Bureau Drive, Stop 8900

Gaithersburg, MD 20899-8900

Phone: (301) 975-2832

Fax: (301) 975-2378

Email: elizabeth.lennon@nist.gov

TO SUBSCRIBE TO THE

ELECTRONIC EDITION OF THE

ITL NEWSLETTER, GO TO

ITL HOMEPAGE

Upcoming Technical 

Conferences

International Biometric Performance Testing Conference 2016

Dates: May 3-5, 2016

Place: NIST, Gaithersburg, Maryland

Sponsors: NIST, Department of Homeland Security, and 

Department of Justice, Federal Bureau of Investigation

Cost: $150 with catering; $61 without catering

A sequel to the IBPC 2010, 2012, and 2014 conferences, this 

international forum will cover advances in the field of biometric 

testing, and performance definition, specification, and assurance. 

The conference seeks to identify fundamental, relevant, effective, 

and new performance metrics and to present best practices for 

performance design, calibration, evaluation, and monitoring. The 

overarching goal is to refine the concept of biometric performance 

and to elevate adoption and effectiveness of biometric 

technologies.

NIST contact: Elham Tabassi, elham.tabassi@nist.gov

IBPC Technical Colloquium: Quantifying the Weight of 

Forensic Evidence

Dates: May 5-6, 2016

Place: NIST, Gaithersburg, Maryland

Cost: None

The purpose of this colloquium is to facilitate a technical 

discussion about theories and current approaches and practices 

for assigning the weight of evidence. The colloquium will address 

different mathematical and statistical methods for quantifying the 

weight of evidence and the development of guidelines for the 

forensic science community.

NIST contact: tc.forensicweightofevidence@nist.gov

NSCI: High-Performance Computing Security Workshop

Dates: May 19-20. 2016

Place: NIST, Gaithersburg, Maryland

The purpose of this workshop is to identify security priorities and 

principles that should be incorporated into the strategy of the 

National Strategic Computing Initiative (NSCI), to bring together 

stakeholders from industry, academia, and government, and to 

identify gaps that should be addressed.

NIST contact: Lee Badger, mark.badger@nist.gov

Workshop on Named Data Networking

Dates: May 31-June 1, 2016

Place: NIST, Gaithersburg, Maryland

Cost: None

NIST has ongoing efforts in Cyber-Physical Systems/Internet of 

Things and Big Data. This workshop will gather representatives 

from industry, government, and academia to discuss the role that 

Named Data Networking (NDN) future internet architecture can 

play in support of these two critical network environments, as well 

as future content delivery over mobile networks.

NIST contact: Lotfi Benmohamed, lotfi.benmohamed@nist.gov

Disclaimer: Any mention of commercial products or reference to 

commercial organizations is for information only; it does not imply 

recommendation or endorsement by the National Institute of 

Standards and Technology nor does it imply that the products 

mentioned are necessarily the best available for the purpose.

The NIST campus at Gaithersburg, MD.

Credit: Katherine Green

4