The National Institute of Standards and Technology (NIST) released a bulletin note from the Information Technology Laboratory (ITL) on cybersecurity risks increasing with remotely accessible telework networks.
ITL says that agencies and organizations should assume that malicious cyber actors will try to gain access to agency systems and that they’ll try to leverage telework devices to gain access to the enterprise network or attempt to recover sensitive data. ITL also says that organizations should assume that communications on external networks are susceptible to eavesdropping, interception, and modification.
“Options for mitigating this type of threat include encrypting the device’s storage, encrypting all sensitive data stored on client devices, and not storing sensitive data on client devices,” the bulletin note explains. “For mitigating device reuse threats, the primary option is using strong authentication – preferably multi-factor – for enterprise access.”
The ITL bulletin summarizes recommendations from NIST Special Publication 800-46 Revision 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device Security, including:
- “Developing and enforcing a telework security policy, such as having tiered levels of remote access;
- [Requiring] multi-factor authentication for enterprise access;
- Using validated encryption technologies to protect communications and data stored on the client devices;
- Ensuring that remote access servers are secured effectively and kept fully patched; and
- Securing all types of telework client devices against common threats.”
Additionally, the bulletin includes information on different types of remote access working and highlights what kind of security concerns can be involved.
“Organizations should carefully consider the balance between the benefits of providing remote access to additional resources and the potential impact of a compromise of those resources,” the bulletin said.
