Security Guidelines for Storage Infrastructure

Abstract

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Data security in the digital age: A consolidated guide for psychologists to understand Health Insurance Portability and Accountability Act-compliant telehealth.

“…Similarly, psychologists should seek wireless access point (WAP) routers that give them or their organization full network control access (Chandramouli & Pinhas, 2020;Grassi et al, 2020). These routers provide wireless access to a wired network.…”

“…To limit the potential for viruses, Ransomware, or other malware, psychologists should utilize automated risk detection and prevention software. Such programs should not only provide general ongoing monitoring for all data on the system/ database, but also conduct scheduled scans of all the systems to ensure nothing has become compromised (Chandramouli & Pinhas, 2020;Grassi et al, 2020). As there is a multitude of free and paid malware software packages, psychologists are suggested to review each for specific features to meet their needs.…”

“…More specifically, psychologists or their organizations should: (a) identify the files that require backing up (vs. a full database level copy), (b) determine the time required for a restoration/repair, (c) determine the relationships among systems to understand any dependencies required to repair or restore the files (e.g., one file is used by multiple programs), (d) determine what backup files need to be secured offline (e.g., encryption keys, passwords, digital certificates or other information needed to reestablish business operations quickly), (e) plan to save more than one backup file following the 3-2-1 rule (i.e., keep three copies of important files that includes one primary and two backups, keep the files on two different media types, and store one copy off-site/outside of the business facility), (f ) develop response and recover procedures and determine the appropriate technical approach to generating backups (e.g., automatic vs. manual), and (g) test the plan (Bartock et al, 2016;NIST and NCCoE, 2020;Paulsen & Toth, 2016). Additionally, a full "point-in-time copy" (i.e., a copy of original data as it appeared at a point in time) of the entire database is recommended to occur on a set schedule (Chandramouli & Pinhas, 2020). Having such a system and plan can reduce disruptions to telehealth services that may arise from an impaired system/database.…”

Secure Cloud Key Management based on Robust Secret Sharing

“…The main concerns are about confidentiality, integrity and privacy of the outsourced data [2,3] CSPs are leveraging cryptography as lever for mitigating security concerns in order to strength confidence of end users on their services. Cryptography can be involved in two major levels of security, namely secure storage [11,[4][5][6][7] and secure gain provided by the solution. The lack of detailed technical information about the solution and about the span of its adoption by final cloud users make the final statement very difficult.…”

Comparative Analysis of Encryption Algorithms Using Simulation Technique

“…More people can only access information services with secure data transfer. Chandramouli & Pinhas (2020) argue that data encryption is a fundamental security method used to protect computer data stored outside of system memory to stop data theft and other malicious activities. Encrypted data makes essential documents much more secure as it makes them difficult to decrypt, even if lost or leaked.…”