衡量高等教育机构对 NIST 认证标准的合规性
Measuring NIST Authentication Standards Compliance by Higher Education Institutions
AI总结：
本文评估美加 135 所高校对 NIST SP 800-63 四项认证标准的合规性，发现多因素认证广泛但未普及，且过时密码与知识认证做法仍常见。
摘要：
技术标准长期以来一直是基于专家共识传达最佳实践建议的方法。网络安全标准对于为保护关键系统和敏感数据的政策提供信息尤为重要。因此，衡量标准合规性对于识别因政策过时而产生的漏洞，并确定专家建议是否已有效传播给从业者至关重要。在本文中，我们考察了美国和加拿大 135 所多样化高校的认证政策，以确定其对 NIST Special Publication 800-63《数字身份指南》中四项标准的合规情况。我们发现各机构广泛但并非普遍部署了多因素认证。我们还发现，密码过期、密码构成规则和基于知识的认证的过时使用十分普遍。这些结果支持进一步投资和研究标准合规的激励结构，以及专家指导向从业者的传播。
英文摘要：
Technical standards are a longstanding method of communicating best practice recommendations based on expert consensus. Cybersecurity standards are particularly important for informing policies that protect critical systems and sensitive data. Measuring standards compliance is therefore essential to identify vulnerabilities arising from outdated policies and to determine whether expert advice has effectively diffused to practitioners. In this paper, we examine the authentication policies of a diverse set of 135 colleges and universities in the United States and Canada to determine compliance with four standards from NIST Special Publication 800-63 Digital Identity Guidelines. We find widespread, but not universal, deployment of multi-factor authentication across institutions. We also find prevalent outdated use of password expiration, password composition rules, and knowledge-based authentication. These results support further investment and research into incentive structures for standards compliance and the diffusion of expert guidance to practitioners.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
