NIST - Security Ticks

NIST proposes new metric to gauge exploited vulnerabilities

CISA, CISO, Don't miss, News, NIST, patching, security metrics, vulnerability assessment, vulnerability management / SecurityTicks

NIST proposes new metric to gauge exploited vulnerabilities 2025-05-26 at 08:06 By Help Net Security NIST has introduced a new way to estimate which software vulnerabilities have likely been exploited, and it’s calling on the cybersecurity community to help improve and validate the method. The new metric, “Likely Exploited Vulnerabilities” (LEV), aims to close a […]

React to this headline:

NIST proposes new metric to gauge exploited vulnerabilities Read More »

Vulnerability Exploitation Probability Metric Proposed by NIST, CISA Researchers

CISA, LEV, NIST, prioritization, Vulnerabilities, vulnerability / SecurityTicks

Vulnerability Exploitation Probability Metric Proposed by NIST, CISA Researchers 2025-05-20 at 15:39 By Eduard Kovacs The Likely Exploited Vulnerabilities (LEV) equations can help augment KEV- and EPSS-based remediation prioritization. The post Vulnerability Exploitation Probability Metric Proposed by NIST, CISA Researchers appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source React

React to this headline:

Vulnerability Exploitation Probability Metric Proposed by NIST, CISA Researchers Read More »

MITRE Warns CVE Program Faces Disruption Amid US Funding Uncertainty

CVE, Featured, Government, MITRE, NIST, NVD, Vulnerabilities / SecurityTicks

MITRE Warns CVE Program Faces Disruption Amid US Funding Uncertainty 2025-04-15 at 23:46 By Ryan Naraine MITRE warns of a deterioration of national vulnerability databases and advisories, slowed vendor reaction and limited response operations. The post MITRE Warns CVE Program Faces Disruption Amid US Funding Uncertainty appeared first on SecurityWeek. This article is an excerpt

React to this headline:

MITRE Warns CVE Program Faces Disruption Amid US Funding Uncertainty Read More »

NIST Puts Pre-2018 CVEs on Back Burner as It Works to Clear Backlog

backlog, CVE, NIST, NVD, Vulnerabilities / SecurityTicks

NIST Puts Pre-2018 CVEs on Back Burner as It Works to Clear Backlog 2025-04-07 at 14:02 By Ionut Arghire NIST has marked pre-2018 CVEs in NVD as ‘Deferred’ and will no longer spend resources on enriching them. The post NIST Puts Pre-2018 CVEs on Back Burner as It Works to Clear Backlog appeared first on

React to this headline:

NIST Puts Pre-2018 CVEs on Back Burner as It Works to Clear Backlog Read More »

NIST Still Struggling to Clear Vulnerability Submissions Backlog in NVD

CISA, CVE, Government, NIST, NVD, Vulnerabilities / SecurityTicks

NIST Still Struggling to Clear Vulnerability Submissions Backlog in NVD 2025-03-24 at 18:21 By Ryan Naraine The effects of the backlog is already being felt in vulnerability management circles where NVD data promises an enriched source of truth. The post NIST Still Struggling to Clear Vulnerability Submissions Backlog in NVD appeared first on SecurityWeek. This

React to this headline:

NIST Still Struggling to Clear Vulnerability Submissions Backlog in NVD Read More »

NIST selects HQC as backup algorithm for post-quantum encryption

Don't miss, Encryption, News, NIST, quantum computing, security standard / SecurityTicks

NIST selects HQC as backup algorithm for post-quantum encryption 2025-03-12 at 13:32 By Help Net Security Last year, NIST standardized a set of encryption algorithms that can keep data secure from a cyberattack by a future quantum computer. Now, NIST has selected a backup algorithm that can provide a second line of defense for the

React to this headline:

NIST selects HQC as backup algorithm for post-quantum encryption Read More »

The compliance illusion: Why your company might be at risk despite passing audits

auditing, CISO, Compliance, CXO, cybersecurity, Don't miss, Fortra, Hot stuff, how-to, ISO 27001, News, NIST, PCI DSS, regulation, strategy, tips / SecurityTicks

The compliance illusion: Why your company might be at risk despite passing audits 2025-02-26 at 08:20 By Mirko Zorz For many CISOs, compliance can feel like a necessary evil and a false sense of security. While frameworks like ISO 27001, SOC 2, and PCI DSS offer structured guidelines, they don’t automatically equate to strong cybersecurity.

React to this headline:

The compliance illusion: Why your company might be at risk despite passing audits Read More »

NIST report on hardware security risks reveals 98 failure scenarios

News, NIST, report / SecurityTicks

NIST report on hardware security risks reveals 98 failure scenarios 2024-11-15 at 05:33 By Mirko Zorz NIST’s latest report, “Hardware Security Failure Scenarios: Potential Hardware Weaknesses” (NIST IR 8517), explores the hidden vulnerabilities in computer hardware, a domain often considered more secure than software. The report highlights how hardware flaws embedded in chip designs can

React to this headline:

NIST report on hardware security risks reveals 98 failure scenarios Read More »

NIST is chipping away at NVD backlog

CVE, Don't miss, Hot stuff, News, NIST, vulnerability assessment, vulnerability management / SecurityTicks

NIST is chipping away at NVD backlog 2024-11-14 at 16:33 By Zeljka Zorz The National Institute of Standards and Technology (NIST) is clearing the backlog of unprocessed CVE-numbered vulnerabilities in the National Vulnerability Database (NVD), but has admitted that their initial estimate of when they would finish the job was “optimistic”. About the NVD The

React to this headline:

NIST is chipping away at NVD backlog Read More »

NIST releases finalized post-quantum encryption standards

DigiCert, Encryption, Government, News, NIST, quantum computing, standards, USA / SecurityTicks

NIST releases finalized post-quantum encryption standards 2024-08-14 at 06:01 By Help Net Security NIST has finalized its principal set of encryption algorithms designed to withstand cyberattacks from a quantum computer. The announced algorithms are specified in the first completed standards from NIST’s post-quantum cryptography (PQC) standardization project and are ready for immediate use. “The transition

React to this headline:

NIST releases finalized post-quantum encryption standards Read More »

Post-Quantum Cryptography Standards Officially Announced by NIST – a History and Explanation

Data Protection, Encryption, IBM, NIST, Post quantum cryptography, Quantum / SecurityTicks

Post-Quantum Cryptography Standards Officially Announced by NIST – a History and Explanation 2024-08-13 at 15:16 By Kevin Townsend SecurityWeek speaks to Michael Osborne, CTO of IBM Quantum Safe, for a better understanding of the need for and principles of quantum safe cryptography. The post Post-Quantum Cryptography Standards Officially Announced by NIST – a History and

React to this headline:

Post-Quantum Cryptography Standards Officially Announced by NIST – a History and Explanation Read More »

Coding practices: The role of secure programming languages

Don't miss, Hot stuff, News, NIST, software development, tips / SecurityTicks

Coding practices: The role of secure programming languages 2024-07-30 at 06:31 By Mirko Zorz Safety and quality are not features that can be added through testing — they must be integral to the design. Opting for a safer or more secure language or language subset during implementation can eliminate entire categories of vulnerabilities. The Software

React to this headline:

Coding practices: The role of secure programming languages Read More »

NIST Getting Outside Help for National Vulnerability Database

CVE, Government, NIST, NVD, Vulnerabilities / SecurityTicks

NIST Getting Outside Help for National Vulnerability Database 2024-05-30 at 18:17 By Eduard Kovacs NIST is receiving support to get the NVD and CVE processing back on track within the next few months. The post NIST Getting Outside Help for National Vulnerability Database appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS

React to this headline:

NIST Getting Outside Help for National Vulnerability Database Read More »

NIST says NVD will be back on track by September 2024

CVE, Don't miss, Hot stuff, News, NIST, vulnerability assessment, vulnerability management / SecurityTicks

NIST says NVD will be back on track by September 2024 2024-05-30 at 14:01 By Zeljka Zorz The National Institute of Standards and Technology (NIST) has awarded a contract for an unnamed company/organization to help them process incoming Common Vulnerabilities and Exposures (CVEs) for inclusion in the National Vulnerability Database (NVD), the agency has announced

React to this headline:

NIST says NVD will be back on track by September 2024 Read More »

NIST unveils ARIA to evaluate and verify AI capabilities, impacts

Artificial Intelligence, cybersecurity, News, NIST / SecurityTicks

NIST unveils ARIA to evaluate and verify AI capabilities, impacts 2024-05-30 at 06:36 By Help Net Security The National Institute of Standards and Technology (NIST) is launching a new testing, evaluation, validation and verification (TEVV) program intended to help improve understanding of artificial intelligence’s capabilities and impacts. Assessing Risks and Impacts of AI (ARIA) aims

React to this headline:

NIST unveils ARIA to evaluate and verify AI capabilities, impacts Read More »

NIST awards $3.6 million to address the cybersecurity workforce gap

Industry news, NIST / SecurityTicks

NIST awards $3.6 million to address the cybersecurity workforce gap 2024-04-04 at 16:47 By Industry News The US Department of Commerce’s National Institute of Standards and Technology (NIST) has awarded cooperative agreements totaling nearly $3.6 million aimed at building the workforce needed to safeguard enterprises from cybersecurity risks. The grants of roughly $200,000 each will

React to this headline:

NIST awards $3.6 million to address the cybersecurity workforce gap Read More »

US gov’t commits $3.6M to address cybersecurity skill shortage

cooperative agreements, cyber threats, cybercrime, cybersecurity, Data Breaches, NIST, skill shortage / SecurityTicks

US gov’t commits $3.6M to address cybersecurity skill shortage 2024-04-04 at 13:01 By Cointelegraph by Savannah Fortis NIST allocated nearly $3.6 million in cooperative agreements to enhance the cybersecurity workforce aiming to combat the growing threat of cyberattacks. This article is an excerpt from Cointelegraph.com News View Original Source React to this headline:

React to this headline:

US gov’t commits $3.6M to address cybersecurity skill shortage Read More »

NVD: NIST is working on longer-term solutions

CVE, Don't miss, Hot stuff, News, NIST, vulnerability management / SecurityTicks

NVD: NIST is working on longer-term solutions 2024-04-03 at 13:17 By Zeljka Zorz The recent conspicuous faltering of the National Vulnerability Database (NVD) is “based on a variety of factors, including an increase in software and, therefore, vulnerabilities, as well as a change in interagency support,” says the U.S. National Institute of Standards and Technology

React to this headline:

NVD: NIST is working on longer-term solutions Read More »

NIST’s NVD has encountered a problem

Chainguard, Don't miss, enterprise, Hot stuff, News, NIST, Qualys, Rapid7, vulnerability, vulnerability management / SecurityTicks

NIST’s NVD has encountered a problem 2024-03-19 at 15:47 By Zeljka Zorz Whether the cause is insurmountable technical debt, lack of funds, a third reason or all of them, NIST’s National Vulnerability Database (NVD) is struggling, and it’s affecting vulnerability management efforts. What happened? Anyone who regularly uses the NVD as a source of information

React to this headline:

NIST’s NVD has encountered a problem Read More »

Integrating software supply chain security in DevSecOps CI/CD pipelines

cybersecurity, DevSecOps, Don't miss, Endor Labs, framework, guidelines, Hot stuff, NIST, supply chain, Video / SecurityTicks

Integrating software supply chain security in DevSecOps CI/CD pipelines 2024-03-04 at 07:01 By Help Net Security NIST released its final guidelines for integrating software supply chain security in DevSecOps CI/CD pipelines (SP 800-204D). In this Help Net Security video, Henrik Plate, Security Researcher at Endor Labs, talks about this report, which provides actionable measures to

React to this headline:

Integrating software supply chain security in DevSecOps CI/CD pipelines Read More »