“Telework and Mobile Security Guidance”
National Security Administration, August 14, 2020
Security Guidance
By NSA-CSS
End User Telework and Network Security Guides
Here are a subset of NSA’s cybersecurity products focused on telework and general network security guidance compiled below for ease of access. While all include resources applicable to the general end user, some delve into more technical solutions as well.
To view all of NSA’s published cybersecurity products, go to our Cybersecurity Advisories & Technical Guidance page.
Telework Best Practices
This joint NSA/DHS CISA slicksheet was designed during the era of COVID-19 to provide a list of “dos and don’ts” as they relate to telework. Helpful for end users using government-owned or personal devices.
Mobile Device Best Practices
This succinct guidance details steps end users may take to better protect their mobile devices and data.
Selecting and Safely Using Collaboration Services
This document provides security assessment guidance about commercially available collaboration services to enable the Department of Defense and other U.S. Government customers to most securely use collaboration platforms who do not have access to a government provided tools, accounts, or equipment.
Best Practices for Securing Your Home Network
Don’t be a victim; cyber criminals may leverage your home network to gain access to personal, private, and confidential information. Help protect yourself and your family by observing some basic guidelines and implementing the following mitigations on your home network.
Keeping Safe on Social Media
This brief guide highlights critical information and countermeasures users may take to help keep themselves and their sensitive data safe while connecting with others on social media.
Limiting Location Data Exposure
Mobile devices expose location data, and there is an associated risk that comes with using them. This report summarizes how and why location data might be shared and provides mitigations to limit this sharing, but warns there is no solution to fully protect a mobile device from being located.
Identity Theft Threat and Mitigations
Criminals can use a multitude of methods to obtain personally identifiable information, which can be used to carry out malicious actions. Personal protection from these actors must be dealt with on all fronts, as a layered approach. The information provided in this document is designed to help individuals protect themselves against identity theft and mitigate the risk.
Steps to Securing Web Browsing
Web browsers pose a unique risk to enterprise infrastructure because of their frequent exposure to untrusted dynamic content. Configuring browser security settings is challenging due to uncertainty of both attack mitigation effectiveness and impact on end users. A key goal of this paper is to avoid impact to users while also mitigating as many attacks as possible.
Mitigating Recent VPN Vulnerabilities
Multiple Nation State Advanced Persistent Threat actors are weaponizing known vulnerabilities to gain access to VPN devices. This document shares actions for compromise recovery and long-term hardening. Helpful for any net defenders or end users responsible for maintaining VPNs.
Securing IPSec Virtual Private Networks (VPNs)
This identifies common VPN misconfigurations and vulnerabilities and an overview of the ways to secure your VPN.
Configuring IPSec Virtual Private Networks (VPNs)
This guidance provides a more in-depth look at how to implement specific configurations for securing and maintaining secure VPN connections.
TENS Virtual Machine Guide
The United States Air Force Trusted End Node Security (TENS) solution allows authorized DoD teleworkers to connect to DoD sites and services from untrusted devices, such as personal computers. This guide provides detailed instructions for configuring a virtual machine to boot TENS until TENS is able to load when a computer uses UEF Secure Boot.
NSA’s Top Ten Cybersecurity Mitigation Strategies
These strategies detail methods to counter a broad range of advanced cyber threats. The information included will help drive robust conversation about network security and risk management on your organization’s networks and are also helpful for individuals looking to better understand any of these mitigations. The Top 10 are ranked based on threat intelligence findings and cybersecurity expertise for effectiveness against known adversary tactics.
- Update and Upgrade Software Immediately
- Defend Privileges and Accounts
- Enforce Signed Software Execution Policy
- Exercise a System Recovery Plan
- Actively Manage Systems and Configurations
- Continuously Hunt for Network Intrusions
- Leverage Modern Hardware Security Features
- Segment Networks and Deploy Application Aware Defenses
- Integrate Threat Reputation Services
- Transition to Multi-Factor Authentication
Read the Full Article & Access Links »
