The US National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) are starting to put together a set of guidelines for tech companies that want to provide networking equipment and services in the future. To that end, the two agencies have released the first in a series of four planned reports that will refine the US government’s cybersecurity strategy moving forward.
The first report comes courtesy of the Enduring Security Framework, which is itself a product of the Critical Infrastructure Partnership Advisory Council for threats and risks to national security systems. It specifically applies to cloud providers and mobile network operators, and details some best practices for security in a 5G environment. Most notably, the report stressed that multi-factor authentication is not sufficient, and that federal organizations need to guard against lateral threats that manage to bypass authentication protocols. Experts now believe that that may have occurred in the SolarWinds attack. Poor password hygiene is at least partly responsible for the initial breach, but the structure of the network itself may have allowed hackers to get around other security measures once one account was compromised.
To solve the problem, the report argues that any device that is accessing a 5G network should have its own unique identity. 5G cloud networks encourage communication between devices, and increased differentiation will help administrators identify and isolate a compromised device before hackers can gain access to the rest of the network. In that regard, the report noted that service providers cannot guarantee a fully secure cloud, and that operators do have some responsibility to make sure that employees using the cloud are following security best practices.
Many of the companies that would be expected to bid on a cloud government contract (including Microsoft and Verizon) are already part of CISA’s public-private Joint Cybersecurity Defense Collaborative, which helps guide the federal government’s cybersecurity objectives. The next three Enduring Security Framework reports will address network resources, data protection practices, and infrastructure integrity.
Source: NextGov
Follow Us