NIST releases telnet, IT security drafts

NIST draft publications

Federal agencies desiring to minimize work disruptions from outside intrusions can begin with simple safeguards, such as preventing unauthorized users from using the telnet protocol to gain access to a server, according to officials at the National Institute of Standards and Technology.

Draft documents on computer security released Jan. 22 by the National Institute of Standards and Technology give an example of how unauthorized telnet users simply identify themselves as a guest to gain access to sensitive government files.

The Risk Management Guide for Information Technology Systems suggests that disabling telnet is about a 10-hour procedure. Practical advice in the 58-page document includes other ways that agencies can develop standards for safeguarding sensitive but unclassified information in federal computer systems. As applied to information systems, the guide says, risk management is a responsibility of executive managers to be shared with technical managers, and not a technical manager's sole responsibility.

Engineering Principles for Information Technology Security, a 33-page document also released this week, offers an overview of accepted principles and practices for security information technology systems.

With the release of both documents in draft form, NIST said it will accept suggestions for revisions until March 20. Those comments can be sent electronically to gary.stoneburner@nist.gov.