NIST SP 800-161r1中的C-SCRM

最新推荐文章于 2025-04-14 09:09:04 发布
最新推荐文章于 2025-04-14 09:09:04 发布
阅读量1.4k 收藏 1
点赞数
分类专栏： 软件供应链 安全要闻 文章标签： 网络 安全
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/qzt961003/article/details/126864911
版权

NIST（美国国家标准和技术研究所）是美国商务部下属的一个联邦机构。NIST成立于1901年，旨在促进美国的创新和工业竞争力，帮助组织推进测量科学、技术和标准，以改善公民的生活质量，提高经济安全。

今年5月初，NIST更新了关于整个网络供应链管理安全风险的建议。这份名为SP 800-161r1的文件中重点关注了C-SCRM（网络软件安全供应链风险管理实践）。

 NIST的C-SCRM项目通过识别、评估和减轻数字供应链固有的风险，帮助组织更有效的管理网络安全供应链风险。

C-SCRM项目涵盖了整个SDLC，包括开发、设计、部署、分发等各个阶段。它通过开展研究、提供资源和召集利益相关者来帮助组织管理其软件供应链安全风险。

一、C-SCRM层级

以此为背景，NIST在SP 800-161r1 中提出了一个三层次的方法来配置和构建一个C-SCRM项目ÿ

最低0.47元/天 解锁文章
NIST SP800-160v1.pdf
02-25
FIPS 201 originally required that all PIV credentials and associated keys be stored in a PIV Card. While the use of the PIV Card for electronic authentication works well with traditional desktop and laptop computers, it is not optimized for mobile devices. In response to the growing use of mobile devices within the Federal government, FIPS 201 was revised to permit the issuance of an additional credential, a Derived PIV Credential, for which the corresponding private key is stored in a cryptographic module with an alternative form factor to the PIV Card. Derived PIV Credentials leverage the current investment in the PIV infrastructure for electronic authentication and build upon the solid foundation of well-vetted and trusted identity of the PIV cardholder – achieving substantial cost savings by leveraging the identity-proofing results that were already performed to issue PIV cards. This document provides the technical guidelines for the implementation of Derived PIV Credentials. The use of a Derived PIV Credential is one possible way to PIV-enable a mobile device. In other cases it may be practical to use the PIV Card itself with the mobile device, using either the PIV Card’s contact or contactless interface, rather than issuing a Derived PIV Credential. Mobile devices are generally too small to integrate smart card readers into the device itself, requiring alternative approaches for communicating between the PIV Card and the mobile device. Some of these approaches are possible by today’s set of available products. Other, newer technologies are addressed by new guidelines in the existing set of PIV Special Publications. The current solution for PIV enablement directly uses PIV Cards with mobile devices through smart card readers. This has the advantage of avoiding the additional time and expense required to issue and manage Derived PIV Credentials. The approach requires smart card readers that are separate from, but attached to, the mobile device itself. These readers interface with the mobile device over a wired interface (e.g., USB) or wireless interface. The use of PIV Cards with mobile devices is functionally similar to their use with laptop and desktop computers. It does not involve new or different requirements to communicate with the PIV Card. Instead, the existing contact interface specifications of the PIV Card, as outlined in SP 800-73, form the basis for these types of readers to communicate with the PIV Card. Newer technology on mobile devices can directly communicate with and use PIV Cards over a contactless interface using Near Field Communication (NFC). Similarly to the mobile devices and attached reader scenario, the use of NFC technology with PIV cards also avoids the additional time and expense required to issue and manage Derived PIV Credentials. NFC uses radio frequency to establish communication between NFC-enabled devices. An NFC-enabled mobile device can interact with a PIV Card over its contactless interface at a very close range, allowing the mobile device to use the keys on the PIV Card without a physical connection. The user would need to hold or place the card next to the mobile device. Earlier PIV specifications did not allow the use of certain keys over the contactless interface, as existing technologies and standards did not support a secure channel between the smart card and the mobile device over NFC. SP 800-73-4 will include a new capability to enable access to all non-card-
NIST SP800-160-vol2-draft.pdf
02-25
INTRODUCTION THE NEED FOR CYBER RESILIENT SYSTEMS he need for trustworthy secure systems1 stems from a variety of stakeholder needs that are driven by mission, business, and other objectives and concerns. The principles, concepts, and practices for engineering trustworthy secure systems can be expressed in various ways, depending on which aspect of trustworthiness is of concern to stakeholders. [NIST 800-160, Vol.1] provides guidance on systems security engineering with an emphasis on protection against asset loss.2 In addition to security, other aspects of trustworthiness include, for example, reliability, safety, resilience, and privacy. Specialty engineering disciplines address different aspects of trustworthiness. While each specialty discipline frames the problem domain and the potential solution space for its aspect of trustworthiness somewhat differently, [NIST 800-160, Vol. 1] includes systems engineering processes to align the concepts, frameworks, and analytic processes from multiple disciplines to make trade-offs within and between the various aspects of trustworthiness applicable to a system-of-interest.3 NIST Special Publication 800-160, Volume 2 focuses on the property of cyber resiliency, which has a strong relationship to security and resilience, but which provides a distinctive framework for its identified problem domain and solution space. Cyber resiliency is the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources regardless of the source.4 Cyber resiliency supports mission assurance in a contested environment, for missions which depend on systems which include cyber resources. A cyber resource is an information resource which creates, stores, processes, manages, transmits, or disposes of information in electronic form and which can be accessed via a network or using networking methods. A cyber resource which can be accessed via a network exists in or has a presence in cyberspace. However, some information resources are designed to be accessed using a networking method only intermittently (e.g., via a low-power connection to check the status of an insulin pump; via a wired connection to upgrade software in an embedded avionic device). These cyber resources are characterized as operating primarily in stand-off mode.5
NIST800-161系统和组织的网络安全供应链风险管理实践.pdf
02-10
NIST 特别出版物 800-161 修订版 系统和组织的网络安全供应链风险管理实践
信息安全管理系列之十 ICT供应链风险管理标准NIST SP800—161探析 (2).docx
06-19
信息安全管理系列之十 ICT供应链风险管理标准NIST SP800—161探析 (2).docx信息安全管理系列之十 ICT供应链风险管理标准NIST SP800—161探析 (2).docx信息安全管理系列之十 ICT供应链风险管理标准NIST SP800—161探析 (2).docx信息安全管理系列之十 ICT供应链风险管理标准NIST SP800—161探析 (2).docx信息安全管理系列之十 ICT供应链风险管理标准NIST SP800—161探析 (2).docx信息安全管理系列之十 ICT供应链风险管理标准NIST SP800—161探析 (2).docx信息安全管理系列之十 ICT供应链风险管理标准NIST SP800—161探析 (2).docx信息安全管理系列之十 ICT供应链风险管理标准NIST SP800—161探析 (2).docx
软件供应链安全标准：NIST SP 800-161 与 GB/T 43698-2024-信息安全领域的重要标准对比
最新发布
chengoodflower的博客
04-14 1173
在数字化浪潮汹涌的当下，信息系统举足轻重。从企业运营视角而言，它是保障业务连续性的生命线。一旦软件供应链遭受攻击，企业可能面临系统瘫痪、数据泄露等灾难，致使业务中断，经济损失惨重，声誉也会一落千丈。对广大用户来说，安全的软件供应链意味着个人隐私与数据安全得以捍卫，免遭恶意软件窃取信息、侵扰生活。上升至国家层面，软件广泛应用于关键基础设施，其供应链安全直接关系到国家经济安全与社会稳定，关乎国计民生。因此，维护信息系统，是企业稳健发展、用户安心使用、国家长治久安的必要前提，不容丝毫懈怠。
nist sp800-16标准
07-16
nist sp800-16标准，对于信息安全从业人员，培训人员等有参考价值
深度分析：美国多角色参与的软件供应链安全保护措施
smellycat000的专栏
02-13 1066
本文2892字阅读约需8分钟自2020年底政府和企业网络遭受大范围SolarWinds攻击以来，美国加快推出软件供应链安全的各类措施。根据2023年2月初的公开报道，美网络安全和基础设施安全局(CISA)正在组建一个新办公室，专注于政府供应链安全并负责向政府机构、行业及其他合作方提供供应链风险管理政策及技术指导。早在去年9至11月间，CISA就联合美国家安全局(NSA)和国家情报总监办公室...
1网络供应链风险管理案例研究(中文版）.pdf
03-16
NIST SP 800 800-161 提供了有关识别，评估和缓解网络供应链风险的指南， 包括 假冒 ，未经授权的生产，篡改，盗窃，插入恶意 软件和硬件，以及各个组织 级别的不良制造和开发实践。 NIST 在 2015 年下半年发布了...
NIST SP800-16.pdf
02-13
Federal agencies and organizations cannot protect the integrity, confidentiality, and availability of information in today’s highly networked systems environment without ensuring that each person involved understands their roles and responsibilities and is adequately trained to perform them. The human factor is so critical to success that the Computer Security Act of 1987 (Public Law [P.L.] 100-235) required that, “Each agency shall provide for the mandatory periodic training in computer security awareness and accepted computer practices of all employees who are involved with the management, use, or operation of each Federal computer system within or under the supervision of that agency.”
NIST SP 800-193(中文)
12-07
这个出版已经由NIST依照法定职责根据联邦信息安全现代化法案》(FISMA) 2014年44事项§3551节。，公法(P.L.) 113-283。NIST负责制定信息安全标准和指南，包括对联邦信息系统的最低要求，但这些标准和指南不应适用于国家安全系统，除非获得对这些系统行使政策权力的适当联邦官员的明确批准。该准则符合管理和预算厅(管理和预算厅)通告A-130的要求
模拟电子技术基础实验.pdf
06-19
。。。
NIST SP 800-53A: 联邦信息系统中安全控制评价指南
04-16
NIST SP 800-53A: 联邦信息系统中安全控制评价指南，与NIST SP 800-53配套
NIST零信任架构SP 800-207 标准草案（中文版）.pdf
06-15
NIST 零信任架构SP 800-207 标准草案 第二版 中文版 云安全联盟大中华区SDP工作组翻译稿
NIST SP800-38C.pdf
02-14
This Recommendation specifies an algorithm, Counter with Cipher Block Chaining-Message Authentication Code [1], abbreviated CCM, that can provide assurance of the confidentiality and authenticity of data. CCM is based on an approved symmetric key block cipher algorithm whose block size is 128 bits, such as the Advanced Encryption Standard (AES) algorithm currently specified in Federal Information Processing Standard (FIPS) Pub. 197 [2]; thus, CCM cannot be used with the Triple Data Encryption Algorithm [3], whose block size is 64 bits. CCM can be considered a mode of operation of the block cipher algorithm.
NIST SP800系列标准
热门推荐
RukeyLee's Tech Blog
08-22 2万+
NIST SP800系列标准         SP800是美国NIST（National Institute of Standards and Technology）发布的一系列关于信息安全的指南（SP是Special Publications的缩写）。文档很多，也很细，值得大家学习。        在NIST的标准系列文件中，虽然NIST SP并不作为正式法定标准，但在实际工作中，已
NIST 网络安全相关标准 美国 （简单整理）
DarkN0te
08-10 1万+
系列 编号 英文名 中文名 状态 时间 ITL Bulleti 　 Security Considerations for Exchanging Files Over the Internet 通过Internet交换文件的安全注意事项 Final 8/03/2020 SP 800-210 General Access Control Guidance for Cloud Syste...
SCRM的全面了解
Admans的专栏
06-11 4860
SCRM（Social CRM，社会化客户关系管理），是以用户为中心，通过社交平台与用户建立联系，以内容、活动、客服、商城等服务吸引用户注意力，并不断与用户产生互动，实现用户管理的系统。它的出现是基于移动电商与社交工具的兴起。在中国，用户现在已经习惯于通过手机购物，并通过多元渠道的信息进行对比决策。比如，用户想要购买⼀款美妆产品，可能不仅会从电商平台获取商品信息，还可能参考社交平台、短视频平台、搜索和资讯、生活服务应用等平台用户评价。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

GitMore

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值