Secure Remote Work Technical Considerations

Overview and User Considerations	Technical Considerations	Secure Use of Collaboration Tools	Device Considerations

What is Remote Working? As cloud technology, collaborative applications and internet connectivity increase, remote working is becoming more prevalent than ever before. Remote work is often done through the following ways: Tunneling - using a secure communications tunnel between a device and a remote access server, usually through a VPN. Portals - a server that offers access to one or more applications via a single interface. Direct Application Access - directly connecting and accessing an application without the use of any remote access software. Remote Desktop(via RDP or VNC) - remotely control a particular host machine through the internet. Threats and Challenges posed by Remote Working By connecting via the internet to potentially classified or sensitive applications or data, there are threats to the safety and security of that information. Security issues may include: Lack of physical security - devices can be stolen, drives can be copied, or people can shoulder surf. Unsecured Networks - connecting to networks that are unsecured such as cafe, hotel and other open public networks are easy targets for exploitation. Providing Internal Access Externally - servers will be exposed to the internet therefore increasing the potential risk and vulnerability of being compromised. Out of Date Software - When using personal devices system updates and patches cannot be guaranteed. These software vulnerabilities can give attackers a window of of opportunity to compromise information and employee data. Conference Hijacking - An unauthorized person joins a conference because it is public or by obtaining the link. Targeted by APT actors - Advanced persistent threat (APT) actors can target open communications to exploit employee data and enterprise information. Recommended Security Measures As the employee will be connected via the internet to potentially classified data and applications it is important that measures are taken to reduce the risk of a security breach. Some helpful considerations to implement include: Mandate the use of multi-factor authentication. Some of these techniques include using an authenticator app, phone verification, etc... Develop and deploy a tiered access control system that ensures permissions are segregated. Ensure remote servers, user endpoints such as smartphones, tablets, laptops and desktops are regularly patched. Secure all remote devices by using anti-malware software and implementing strong firewall rules. Use validated encryption to protect data at rest and in transmission. Encrypt device storage such as hard drives, SD Cards, USB Keys, etc... Devise policies that detail how a teleworker will access applications remotely as well as what applications and parts of the network they have access to. Disable or limit the ability to install applications on devices such as laptops and smartphones. Use CCCS/CSE approved cryptography when applicable. Home Network Hardening Out of the box, most routers have generic passwords, are out of date, and often contain exploits that can easily be used to intercept, manipulate and store network traffic. However, there are a number of actions that you can take to mitigate these security issues at home. The following were taken from a CyberScoop report that details measures to protect home networks. Enable Auto-Updates on endpoint devices. Not only on laptops and smartphones but also on the router itself. Disable remote management and administrator function. Change the routers default password to something that is unique and adheres to the GC Password Guidance. Ensure that any web-based management account for the router is also using a strong, unique password. Place IoT devices on a separate router or VLAN. Double check which device address' are connecting to the router if possible. Use WPA2 or WPA3 security instead of WEP if possible. Disable guest-network features. If possible use an ethernet cable to connect directly to the router. This provides typically better performance and increased security. Disable WPS (Wi-Fi Protected Setup). Tools can be used to leverage this feature in order to steal passwords. Disable SSID broadcasting. This allows your network to become discoverable by those especially in range of the router. On occasion reboot the router. (weekly, monthly, etc...) Use the lower powered router setting. This helps shrink the attack surface, especially in dense residential areas. If purchasing a new home networking equipment, avoid using second-hand/preowned or unsupported routers. For more information, check out this CyberScoop report. Canadian Shield The Canadian Internet Registration Authority (CIRA) have recently launched a free protected DNS service that prevents users from connecting to malicious websites and hosts. Over 80% of cyber attacks leverage DNS servers. If attackers are able to connect your device to their compromised DNS, they can begin dropping and installing malware. DNS servers translate human readable addresses into machine readable addresses. For example, if the "wiki.gccollab.ca" address is typed in on a web browser in a human language, the DNS server will match the address to another machine readable address as a set of numbers like "52.139.83.135". Canadian Shield uses data and threat intelligence to determine which DNS address request is being sent and if it is likely to be malicious. Once Canadian Shield determines that it is in fact malicious, it blocks the your request preventing your device from being infected. Canadian Shield is offered on workstations, laptops, tablets and smartphones that are running iOS or Android. Criteria to consider when choosing a collaborative application When choosing or deciding which public applications to use for your work, consider the following excerpt from the Nation Security Agency's publication: Does the application the application support end-to-end (E2E) encryption? Are strong, well-known, testable encryption standards used? Is multi-factor authentication (MFA) used to validate users’ identities? Can users see and control who connects to collaboration sessions? Does the service privacy policy allow the vendor to share data with third parties or affiliates? Do users have the ability to securely delete data from the service and its repositories as needed? Has the collaboration service’s source code been shared publicly (e.g. open source)? Is the service developed and/or hosted under the jurisdiction of a government with laws that could jeopardize government standards and policy? References Secure Teleworking Bulletin - NIST Publication Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security - NIST Publication Telework Security Issues - CCCS Publication Virtual Private Networks - CCCS Publication Guidance For the Secure Use of Collaboration Tools - TBS Orientation sur la facilitation de l’accès aux services Web - SCT Slack, Zoom, Google Hangouts: Are Your Remote Work Apps Spying on You? Selecting and using collaborative tools securely - NSA Starter Guide for Taking Part in a Zoom Call - EN Guide de démarrage pour participer un appel Zoom - FR Cryptographic Algorithms for Unclassified, Protected A and Protected B Information - ITSP.40.111