Amid Coronavirus, CISA and NIST Issue Guidelines to Boost Federal Telecommuting

The federal government continues to refine its teleworking policies in the wake of the coronavirus pandemic, even acting over the weekend to issue guidelines designed to make it easier for federal workers and contractors to perform their jobs from remote locations. And while many private businesses have allowed significant portions of their workforce to telecommute for years, governments have been slow to follow suit, especially at the federal level. 

Now federal agencies must suddenly learn how to manage large numbers of employees working from home, with no realistic estimate about how long they will need to continue to do that. Any telecommuting plans designed for short periods of time are wishful thinking at best during this pandemic. It might be June or July before we get a handle on the virus, and even that might be overly hopeful.

Predictably, this forced rush to telecommuting has caused many problems, with one of the most concerning being a surge in targeted attacks against strained federal networks. Hackers are taking advantage of the telecommuting chaos to launch attacks across the spectrum.

One of the biggest reasons why government networks are straining right now is their reliance on virtual private networks (VPN) to connect remote employees with their agency networks. VPNs have a lot of problems, which is why Gartner predicts that by 2023, 60% of private companies will have phased them out in favor of zero-trust networking and other technologies. And even today, almost nobody is using VPNs for large-scale connectivity. 

The problems with VPNs are myriad. They don’t easily support network segmentation, have zero native on-site security and don’t function well in conjunction with a dynamic or software-defined network. Sometimes they even mess up when trying to tunnel over Wi-Fi, which is how many newly homebound workers will try and connect. They are also heavily constrained by licensing issues, so that an agency supporting limited telecommuting before the coronavirus outbreak may need to buy thousands of new seats if they expect everyone working from home to be able to connect at the same time. And even then, VPNs require massive bandwidth to operate, and agency networks may simply not be able to support such a huge spike in use.

With agencies scrambling to try and make their VPN plow horses run more like thoroughbreds, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency  just released a set of VPN guidelines that might solve, or at least workaround, major chokepoints the government is experiencing. 

Some tips in CISA’s AA20-073A Alert include:

• Defining network rules to ensure information technology teams have full access to log reviews, attack detection tools and the ability to respond to and remediate threats.
• Implement rate limiting and prioritize users that require higher bandwidths.

• Require multifactor authentication for all users.

• Warn employees using agency VPNs about the strong possibility of increased phishing attacks and give them clear ways to report suspected phishing attempts.

• Agencies should report incidents, phishing, malware and all other cybersecurity concerns to CISA immediately.

The CISA guidelines are good, though agencies should probably also try and stagger the workload by having different groups work at different times. That would stretch both their limited bandwidth and licenses, though some people may be forced to work at odd hours like the middle of the night.

Another way that federal agencies are keeping their workers in the loop is with teleconferencing. This is a good move because conference calls may not need to strain agency data networks in a crisis. Virtual meetings on computers are also an option, but depending on how they are configured, may be reliant on the VPN backbone, which is already overloaded.

At least with voice-only teleconferencing, it’s a technology that works well despite its age and less technical design. The problems agencies will face with teleconferencing is not about technology. It’s more so about employees who are used to working in the office every day suddenly having to teleconference without knowing the basic rules, much less how to give calls the appropriate level of security.

For that, NIST’s Jeff Greene has created a guide about how to safely teleconference and keep agency secrets secure. The suggestions in the NIST guide is fairly straightforward, though they might not be obvious to those who don’t regularly join conferences. They include:

• Using a dashboard to identify all meeting participants and booting unauthorized lurkers.

• Protecting sensitive calls with one-time, expiring PIN codes.

• Disabling any features that are not needed, such as file sharing for computer-based conference services or recording for voice calls.

• Being careful about non-mission side conversations, as you may not know exactly who is listening.

• Using a notification tone when someone joins a call and having call moderators ask all new people to identify themselves.

And most critically, know your agency’s policies for virtual meeting security. The paper offers a helpful chart with some good suggestions that increase in severity alongside a call’s importance and classification.

It might seem like a mad scramble toward telecommuting in government right now, but you could almost consider this a practical side effect of the current crisis. The pandemic is forcing agencies to implement secure telecommuting policies and technology that have been delayed for far too long. Some agencies may decide to keep their telecommuting in place after the virus is defeated, reaping rewards in productivity and quality of life that many private companies enjoy as part of their normal routine. And even if they don’t, having the ability to quickly transition to a telecommuting footprint during a crisis or disaster will be a new capability that should allow agencies to respond much more quickly the next time around.

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology. He is the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys