Computer Security Enhancement Act of 1997

Computer Security Enhancement Act of 1997 - Amends the National Institute of Standards and Technology Act to authorize the National Institute of Standards and Technology (Institute), in fulfilling the establishment of the computer standards program, to: (1) upon request from the private sector, assist in establishing voluntary interoperable standards, guidelines, and associated methods and techniques to facilitate and expedite the establishment of non-Federal public key management infrastructures that can be used to communicate with and conduct transactions with the Federal Government; and (2) provide assistance to Federal agencies in the protection of computer networks, and to coordinate Federal response efforts related to unauthorized access to Federal computer systems. Authorizes the Institute to perform evaluation and tests of: (1) information technologies to assess security vulnerabilities; and (2) commercially available security products for their suitability for use by Federal agencies for protecting sensitive information in computer systems.

(Sec. 5) Requires the Institute to carry out specified activities in the development of uniform standards and guidelines for the cost-effective security and privacy of sensitive information in certain Federal computer systems.

(Sec. 6) Directs the Institute to solicit the recommendations of the Computer System Security and Privacy Advisory Board (Board) regarding standards and guidelines that are being considered for submittal to the Secretary of Commerce.

Authorizes separate appropriations for FY 1998 and 1999 to enable the Board to identify emerging issues related to computer security, privacy, and cryptography and to convene public meetings on those subjects, receive presentations, and publish reports, digests, and summaries for public distribution on those subjects.

(Sec. 7) Sets forth requirements for the evaluation of the capabilities of encryption technologies embodied in the form of software or hardware that are offered and generally available outside of the United States.

(Sec. 8) Prohibits the Institute from promulgating, enforcing, or otherwise adopting standards, or carrying out activities or policies, for the Federal establishment of encryption standards required for use in computer systems other than Federal Government computer systems.

(Sec. 9) Revises specified requirements, including to authorize (currently requires) the Institute, for the purposes of performing research and conducting studies, to draw upon computer system security guidelines developed by the National Security Agency.

(Sec. 10) Amends the Computer Security Act of 1987 to revise requirements regarding Federal computer system security training to require that such training include emphasis on protecting sensitive information in Federal databases and Federal computer sites that are accessible through public networks.

(Sec. 11) Authorizes appropriations for FY 1998 and 1999, for fellowships to support students at institutions of higher learning in computer security.

(Sec. 12) Requires a study by National Research Council of the National Academy of Sciences of public key infrastructures. Authorizes appropriations for carrying out the study.