[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-90":3},{"item":4,"lessons":16,"controls":39,"related":67},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-90","SP 800-90","SP 800-90A Rev. 1: Recommendation for Random Number Generation Using Deterministic Random Bit Generators",7,"US National Institute of Standards and Technology (NIST)","**What it covers.** Part of the NIST SP 800-90 series on random bit generation. SP 800-90A specifies approved deterministic random bit generator mechanisms; SP 800-90B covers entropy sources and SP 800-90C covers how to construct complete random bit generators. Revision 1 of 800-90A removed the Dual_EC_DRBG mechanism.\n\n**In practice.** Organisations rely on validated cryptographic modules and operating system random number generators that implement these mechanisms, rather than writing their own. Developers use cryptographically secure APIs for keys, tokens and nonces. Evidence includes use of validated modules and code review showing secure random functions.\n\n**Common gaps.** Common gaps are use of non-cryptographic random functions for security tokens and poor entropy in embedded or virtual environments. Cloned virtual machines that share random generator state are a further known risk.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},5,[19,23,27,31,35],{"slug":20,"title":21,"published_at":22},"decade-old-weak-rng-in-cryptojs-drains-57m-from-crypto-wallets","Decade-Old Weak RNG in CryptoJS Drains $5.7M from Crypto Wallets","2026-08-06T14:21:48.464+00:00",{"slug":24,"title":25,"published_at":26},"coldcard-firmware-flaw-drains-89m-in-bitcoin-due-to-weak-seed-entropy","COLDCARD Firmware Flaw Drains $89M in Bitcoin Due to Weak Seed Entropy","2026-08-03T18:20:26.181+00:00",{"slug":28,"title":29,"published_at":30},"coldcard-rng-flaw-exposes-88m-bitcoin-loss-from-deterministic-seed-generation","COLDCARD RNG Flaw Exposes $88M Bitcoin Loss from Deterministic Seed Generation","2026-08-02T22:20:23.957+00:00",{"slug":32,"title":33,"published_at":34},"firmware-prng-flaw-drains-70m-in-bitcoin-in-under-an-hour","Firmware PRNG Flaw Drains $70M in Bitcoin in Under an Hour","2026-08-01T18:20:22.606+00:00",{"slug":36,"title":37,"published_at":38},"weak-randomness-in-crypto-wallets-enables-31m-recovery-phrase-attack","Weak Randomness in Crypto Wallets Enables $3.1M Recovery Phrase Attack","2026-07-10T10:20:49.318+00:00",[40,45,49,54,59,63],{"slug":41,"name":42,"problem":43,"stories":44},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",4,{"slug":46,"name":47,"problem":48,"stories":44},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":50,"name":51,"problem":52,"stories":53},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",2,{"slug":55,"name":56,"problem":57,"stories":58},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":60,"name":61,"problem":62,"stories":58},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",{"slug":64,"name":65,"problem":66,"stories":58},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[68,73,78,83,87,91,96,100],{"family":69,"item":70,"code":71,"title":72,"together":17},"cis","7","Control 7","Continuous Vulnerability Management",{"family":69,"item":74,"code":75,"title":76,"together":77},"16","Control 16","Application Software Security",3,{"family":79,"item":80,"code":81,"title":82,"together":77},"nist-csf","pr-ip","PR.IP-12","Information Protection Processes and Procedures (CSF 1.1)",{"family":5,"item":84,"code":85,"title":86,"together":77},"800-193","SP 800-193","SP 800-193: Platform Firmware Resiliency Guidelines",{"family":69,"item":88,"code":89,"title":90,"together":77},"2","Control 2","Inventory and Control of Software Assets",{"family":92,"item":93,"code":94,"title":95,"together":53},"gdpr","32","Article 32","Security of processing",{"family":79,"item":97,"code":98,"title":99,"together":53},"de-cm","DE.CM-1","Continuous Monitoring",{"family":101,"item":102,"code":103,"title":103,"together":53},"itil","overview","ITIL"]