Regulatory Compliance Standards and Frameworks

Appendix I: Telework Security Considerations

Many people telework, which is the ability of an organization’s employees and contractors to conduct work from locations other than the organization’s facilities. Teleworkers use various devices, such as desktop and laptop computers, cell phones, and personal digital assistants (PDAs), to read and send email, access Web sites, review and edit documents, and perform many other tasks. Most teleworkers use remote access, which is the ability of an organization’s users to access its nonpublic computing resources from locations other than the organization’s facilities. Organizations have many options for providing remote access, including virtual private networks, remote system control, and individual application access (e.g., Web-based email).

This appendix provides considerations and tips for securing external devices used for telework and remote access. More detailed information on this topic is available in NIST SP 800-114, User’s Guide to Securing External Devices for Telework and Remote Access.
Before teleworking, users should understand their organization’s policies and requirements, as well as appropriate ways of protecting the organization’s information that they may access.

Teleworkers should consult their organization’s policies and requirements to provide adequate security to protect the organization’s information. Sensitive information that is stored on, or sent to or from, external telework devices needs to be protected so that malicious parties can neither access nor alter it. An unauthorized release of sensitive information could damage the public’s trust in an organization, jeopardize the mission of an organization, or harm individuals if their personal information has been released. Teleworkers should ensure that all the devices on their wired and wireless home networks are properly secured, as well as the home networks themselves.

An important part of telework and remote access security is applying security measures to the personal computers (PCs) and consumer devices using the same wired and wireless home networks to which the telework device normally connects. If any of these other devices become infected with malware or are otherwise compromised, they could attack the telework device or eavesdrop on its communications. Teleworkers should also be cautious about allowing others to place devices on the teleworkers’ home networks, in case one of these devices is compromised.

Teleworkers should apply security measures to the home networks to which their telework devices normally connect. One example of a security measure is using a broadband router or firewall appliance to prevent computers outside the home network from initiating communications with telework devices on the home network. Another example is ensuring that sensitive information transmitted over a wireless home network is adequately protected through strong encryption. Teleworkers should consider the security state of a third-party device before using it for telework.

Teleworkers often want to perform remote access from third-party devices, such as checking email from a kiosk computer at a conference. However, teleworkers typically do not know if such devices have been secured properly or if they have been compromised. Consequently, a teleworker could use a third-party device infected with malware that steals information from users (e.g., passwords or email messages). Many organizations either forbid third-party devices to be used for remote access or permit only limited use, such as for Web-based email. Teleworkers should consider who is responsible for securing a third-party device and who can access the device before deciding whether or not to use it. Whenever possible, teleworkers should not use publicly accessible third-party devices for telework, and teleworkers should avoid using any third-party devices for performing sensitive functions or accessing sensitive information.

Secure a Telework PC

• Teleworkers who use their own desktop or laptop PCs for telework should secure their operating systems and primary applications.
• Use a combination of security software, such as antivirus and antispyware software, personal firewalls, spam and Web content filtering, and popup blocking, to stop most attacks, particularly malware;
• Restrict who can use the PC by having a separate standard user account for each person, assigning a password to each user account, using the standard user accounts for daily use, and protecting user sessions from unauthorized physical access;
• Ensure that updates and patches are regularly applied to the operating system and primary applications, such as Web browsers, email clients, instant messaging clients, and security software;
• Disable unneeded networking features on the PC and configure wireless networking securely;
• Configure primary applications to filter content and stop other activity that is likely to be malicious;
• Install and use only known and trusted software;
• Configure remote access software based on the organization’s requirements and recommendations; and
• Maintain the PC’s security on an ongoing basis, such as changing passwords regularly and checking the status of security software periodically.

Secure consumer devices used for telework, such as cell phones, PDAs, and video game systems
A wide variety of consumer devices exists, and security features available for these devices also vary widely. Some devices offer only a few basic features, whereas others offer sophisticated features similar to those offered by PCs. This does not necessarily imply that more security features are better; in fact, many devices offer more security features because the capabilities they provide (e.g., wireless networking, instant messaging) make them more susceptible to attack than devices without these capabilities. General recommendations for securing telework devices are as follows:

• Limit access to the device, such as setting a personal identification number (PIN) or password and automatically locking a device after an idle period;
• Disable networking capabilities, such as Bluetooth, except when they are needed;
• Use additional security software, such as antivirus software and personal firewalls, if appropriate;
• Ensure that security updates, if available, are acquired and installed at least monthly, or more frequently; and
• Configure applications to support security (e.g., blocking activity that is likely to be malicious).

Secure Information

• Use physical security controls for telework devices and removable media. For example, an organization might require that laptops be physically secured using cable locks when used in hotels, conferences, and other locations where third parties could easily gain physical access to the devices.
• Organizations may also have physical security requirements for papers and other non-computer media that contain sensitive information and are taken outside the organization’s facilities.
• Encrypt files stored on telework devices and removable media such as CDs and flash drives. This prevents attackers from readily gaining access to information in the files. Many options exist for protecting files, including encrypting individual files or folders, volumes, and hard drives. Generally, using an encryption method to protect files also requires the use of an authentication mechanism (e.g., password) to decrypt the files when needed.
• Ensure that information stored on telework devices is backed up. If something adverse happens to a device, such as a hardware, software, or power failure or a natural disaster, the information on the device will be lost unless it has been backed up to another device or removable media. Some organizations permit teleworkers to back up their local files to a centralized system (e.g., through VPN remote access), whereas other organizations recommend that their teleworkers perform local backups (e.g., burning CDs, copying files onto removable media). Teleworkers should perform backups, following their organizations’ guidelines, and verify that the backups are valid and complete. It is important that backups on removable media be secured at least as well as the device that they backed up. For example, if a computer is stored in a locked room, then the media also should be in a secured location; if a computer stores its data encrypted, then the backups of that data should also be encrypted.
• Ensure that information is destroyed when it is no longer needed. For example, the organization’s files should be removed from a computer scheduled to be retired or from a third-party computer that is temporarily used for remote access. Some remote access methods perform basic information cleanup, such as clearing Web browser caches that might inadvertently hold sensitive information, but more extensive cleanup typically requires using a special utility, such as a disk-scrubbing program specifically designed to remove all traces of information from a device. Another example of information destruction is shredding telework papers containing sensitive information once the papers are no longer needed.
• Erase information from missing cell phones and PDAs. If a cell phone or PDA is lost or stolen, occasionally its contents can be erased remotely. This prevents an attacker from obtaining any information from the device. The availability of this service depends on the capabilities of the product and the company providing network services for the product.
• Adequately protect remote access-specific authenticators
• Teleworkers need to ensure that they adequately protect their remote access-specific authenticators, such as passwords, personal identification numbers (PINs), and hardware tokens. Such authenticators should not be stored with the teleworking computer, nor should multiple authenticators be stored with each other (e.g., a password or PIN should not be written on the back of a hardware token).

Social Engineering

• Teleworkers should be aware of how to handle threats involving social engineering, which is a general term for attackers trying to trick people into revealing sensitive information or performing certain actions, such as downloading and executing files that appear to be benign but are actually malicious. For example, an attacker might approach a teleworker in a coffee shop and ask to use the computer for a minute or offer to help the teleworker with using the computer.
• Teleworkers should be wary of any requests they receive that could lead to a security breach or to the theft of a telework device.

Handling a Security Breach

• If a teleworker suspects that a security breach (including loss or theft of materials) has occurred involving a telework device, remote access communications, removable media, or other telework components, the teleworker should immediately follow the organization’s policy and procedures for reporting the possible breach. This is particularly important if any of the affected telework components contain sensitive information such as EPHI so that the potential impact of a security breach is minimized.

Read Next: CIS Critical Security Controls Version 8