Insights

11 Aug

Staff Spotlight: NIST’s Human Factors Scientist

Insights

For years, NIST has been conducting research in the areas of human-centered design and evaluation, usable cybersecurity, public safety communication technology, augmented-reality usability, biometrics usability, human factors, and cognitive engineering. We asked Yee-Yin Choong, a Human Factors Scientist in the Visualization and Usability Group, Information Technology Laboratory at NIST about her research and experience working in this unique field. Yee-Yin’s research goal is to understand people’s perceptions, expectations, experiences, and behaviors of human-system interactions –…

Read More
22 Jul

Automatic Proofs of Differential Privacy

Insights

Credit: metamorworks/shutterstock.com We are excited to introduce our fourth guest author in this blog series, Chike Abuah, PhD student in computer science at the University of Vermont, whose research expands the state of the art in the subject of this blog post: static and dynamic analysis approaches to automatic proofs of differential privacy. – Joseph Near and David Darais Previously, we have discussed some differentially private algorithms and implementation bugs which can cause these algorithms…

Read More
19 Jul

IoT Non-Technical Supporting Capabilities: You Talked, We Listened

Insights

Credit: Shutterstock/Cagkan Sayin As part of our ongoing community engagement following the publication of four IoT cybersecurity draft documents in December 2020, NIST conducted a quartet of roundtable discussions in June 2021 focused on draft NISTIR 8259B, IoT Non-Technical Supporting Capability Core Baseline. The roundtables spanned four weeks, and addressed the four core capabilities defined in NISTIR 8259B as well as general discussions on applying the baseline: June 8:  Documentation June 15:  Information Reception and…

Read More
29 Jun

Small Devices Can Cause Big Problems: Improving Enterprise Mobile Device Security

Insights

Mobile phones—those mini-computers in our pockets—are a permanent fixture in today’s workplace. Managing and securing them is no simple task. Gema Howell, computer scientist and mobile device project lead at the National Institute of Standards and Technology’s (NIST’s) National Cybersecurity Center of Excellence (NCCoE), joined us for a recent Learning Series* webinar to discuss the challenges of enterprise mobile device security and privacy. She also shared tips for securing mobile devices. Below is a sneak…

Read More
16 Sep

Microsoft Windows JPEG component buffer overflow

Attacks, Insights, Malware

Systems Affected This vulnerability affects the following Microsoft Windows operating systems by default: Microsoft Windows XP and Microsoft Windows XP Service Pack 1 Microsoft Windows XP 64-Bit Edition Service Pack 1 Microsoft Windows XP 64-Bit Edition Version 2003 Microsoft Windows Server 2003 Microsoft Windows Server 2003 64-Bit Edition Other Microsoft Windows operating systems, including systems running Microsoft Windows XP Service Pack 2, are not affected by default. However, this vulnerability may affect all versions of…

Read More
14 Sep

Vulnerability in Microsoft Image Processing Component

Attacks, Insights, Malware

Systems Affected Applications that process JPEG images on Microsoft Windows, including but not limited to Internet Explorer Microsoft Office Microsoft Visual Studio Picture It! Applications from other vendors besides Microsoft Overview An attacker may be able to gain control of your computer by taking advantage of the way some programs process the JPEG image format. Solution Apply a patch Microsoft has issued updates to address the problem. Obtain the appropriate update from Windows Update and…

Read More
03 Sep

Vulnerabilities in MIT Kerberos 5

Attacks, Insights, Malware

Systems Affected MIT Kerberos 5 versions prior to krb5-1.3.5 Applications that use versions of MIT Kerberos 5 libraries prior to krb5-1.3.5 Applications that contain code derived from MIT Kerberos 5 Updated vendor information is available in the systems affected section of the individual vulnerability notes. Overview The MIT Kerberos 5 implementation contains several vulnerabilities, the most severe of which could allow an unauthenticated, remote attacker to execute arbitrary code on a Kerberos Distribution Center (KDC).…

Read More
01 Sep

Multiple Vulnerabilities in Oracle Products

Attacks, Insights, Malware

Systems Affected The following Oracle applications are affected: Oracle Database 10g Release 1, version 10.1.0.2 Oracle9i Database Server Release 2, versions 9.2.0.4 and 9.2.0.5 Oracle9i Database Server Release 1, versions 9.0.1.4, 9.0.1.5 and 9.0.4 Oracle8i Database Server Release 3, version 8.1.7.4 Oracle Enterprise Manager Grid Control 10g, version 10.1.0.2 Oracle Enterprise Manager Database Control 10g, version 10.1.0.2 Oracle Application Server 10g (9.0.4), versions 9.0.4.0 and 9.0.4.1 Oracle9i Application Server Release 2, versions 9.0.2.3 and 9.0.3.1…

Read More
30 Aug

Security Improvements in Windows XP Service Pack 2

Attacks, Insights, Malware

Systems Affected Microsoft Windows XP Overview Microsoft Windows XP Service Pack 2 (SP2) significantly improves your computer’s defenses against attacks and vulnerabilities. Recommendation To help protect your Windows XP computer from attacks and vulnerabilities, install Service Pack 2 using Windows Update or Automatic Updates. Note: Service Pack 2 makes significant changes to improve the security of Windows XP, and these changes may have negative effects on some programs and Windows functionality. Before you install Service…

Read More
04 Aug

Multiple Vulnerabilities in libpng

Attacks, Insights, Malware

Systems Affected Applications and systems that use the libpng library. Overview Several vulnerabilities exist in the libpng library, the most serious of which could allow a remote attacker to execute arbitrary code on an affected system. Description The Portable Network Graphics (PNG) image format is used as an alternative to other image formats such as the Graphics Interchange Format (GIF). The libpng is a popular reference library available for application developers to support the PNG…

Read More