TIM-7031

Computer Security Division, I. T. L. (2016, November 30). About the rmf—Nist risk management framework | csrc | csrc. CSRC | NIST. https://csrc.nist.gov/projects/risk-management/about-rmf

This resource provides a brief overview of the NIST RMF, including information on each required step.

Force, J. T. (2018). Risk management framework for information systems and organizations: A system life cycle approach for security and privacy (final public draft) (NIST Special Publication (SP) 800-37 Rev. 2 (Draft)). National Institute of Standards and Technology.

In this publication, the author and NIST discuss using the Risk Framework and system lifecycle.

Wen, S.-F., & Katt, B. (2023). A metamodel for web application security evaluation. 2023 34th Conference of Open Innovations Association (FRUCT), Open Innovations Association (FRUCT), 2023 34th Conference Of, 172–182. https://doi.org/10.23919/FRUCT60429.2023.10328176

The authors focus on integrating the Open Web Application Security Project's (OWASP) Application Security Verification Standard (ASVS) into a structured and analyzable metamodel.

Shah, T., Sampangi, R., & Siegel, A. (2024). Mobile Application Security Risk Score: A sensitive user input-based approach. 2024 IEEE 3rd International Conference on AI in Cybersecurity (ICAIC), AI in Cybersecurity (ICAIC), 2024 IEEE 3rd International Conference On, 1–10. https://doi.org/10.1109/ICAIC60265.2024.10433828

The research contributes to the field by offering a user-centric framework that combines various risk score calculation models and term sensitivity identification techniques tailored specifically for mobile applications and addresses the potential risks arising from sensitive user inputs.

Patil, S., Rao, M., Misal, L., Phaldesai, D., & Shivsharan, K. (2023). A review of the OW ASP top 10 web application security risks and best practices for mitigating these risks. 2023 7th International Conference On Computing, Communication, Control And Automation (ICCUBEA), Computing, Communication, Control And Automation (ICCUBEA), 2023 7th International Conference On, 1–8. https://doi.org/10.1109/ICCUBEA58933.2023.10392030

This research seeks to increase awareness of the significance of web application security by thoroughly reviewing the OWASP Top 10 web application security concerns.

Liu, L., Zeng, Z., Long, Y., & Yang, H. (2022). Revisiting hazard analysis requirements. 2022 9th International Conference on Dependable Systems and Their Applications (DSA), Dependable Systems and Their Applications (DSA), 2022 9th International Conference on, DSA, 437–445. https://doi.org/10.1109/DSA56465.2022.00064

The authors discussed well-established hazard analysis procedures and approaches, such as, PHA, HAZOP, FMEA, Fault-Tree, LOPA, etc. Together with safety assurance guidelines and regulations of a particular industrial sector, these approaches can help improve the state of the practice.

Zhang, S., Zhai, X., & Wu, J. (2023). Application of fault tree analysis in fault diagnosis of detectors in nuclear power plant. 2023 CAA Symposium on Fault Detection, Supervision and Safety for Technical Processes (SAFEPROCESS), Fault Detection, Supervision and Safety for Technical Processes (SAFEPROCESS), 2023 CAA Symposium On, 1–5. https://doi.org/10.1109/SAFEPROCESS58597.2023.10295723

Fault Tree Analysis (FTA) is a commonly used and effective method for analyzing the causes of complex systems.

Alghaithi, S., Alkaabi, A., Al Hamadi, H., Al-Dmour, N. A., & Ghazal, T. M. (2022). A Study of Risk Management Frameworks and Security Testing For Secure Software Systems. 2022 International Conference on Electrical, Computer, Communications and Mechatronics Engineering (ICECCME), Electrical, Computer, Communications and Mechatronics Engineering (ICECCME), 2022 International Conference On, 1–4. https://doi.org/10.1109/ICECCME55909.2022.9988363

This study shows that risk management frameworks, such as mobile security and security testing, effectively detect potential risks and defects to secure software systems.

Ampel, B. M., Samtani, S., Zhu, H., Chen, H., & Nunamaker Jr., J. F. (2024). Improving threat mitigation through a cybersecurity risk management framework: A computational design science approach. Journal of Management Information Systems, 41(1), 236–265. https://doi.org/10.1080/07421222.2023.2301178

The authors developed a novel information technology artifact, ATT&CK-Link, which incorporates a novel transformer and multi-teacher knowledge distillation design to link hacker threats to this broadly used framework.

Piper, D. (2023). Regulatory update nist publishes artificial intelligence risk management framework and resources. Journal of Internet Law, 26(6), 1–14. https://search.ebscohost.com/login.aspx?direct=true&AuthType=sso&db=bth&AN=162228641&site=eds-live&scope=site&custid=natuniv

The AI RMF follows a direction from Congress for NIST to develop the framework and was produced in close collaboration with the private and public sectors.