Which Special Publication describes attacker tools such as backdoors?

• A. SP 800-83 - Guide to Malware Incident Prevention and Handling
• B. SP 800-70 Rev2 - National Checklist Program
• C. SP 800-66 Rev 1 - HIPAA Security Rules
• D. SP 800-53 - Security and Privacy Controls

Answer: (A)

Understanding malware and attacker tools is what's being tested here. A backdoor is a technique attackers use to maintain access, which falls under malware incident scenarios. NIST Special Publication 800-83, Guide to Malware Incident Prevention and Handling, specifically covers malware threats and the steps to prevent and respond to malware incidents, including how attackers use tools like backdoors. It provides guidance on detection, containment, eradication, recovery, and post-incident analysis. The other publications serve different purposes: SP 800-70 Rev2 focuses on a national checklist program, SP 800-66 Rev 1 covers HIPAA security rules, and SP 800-53 outlines a broad set of security and privacy controls without the same focused malware incident guidance. So SP 800-83 is the one that describes attacker tools such as backdoors.