SOLUTION BRIEF

Security and Compliance for
Remote Federal Workers
Adapting to Remote Work Environments

Highlights
In response to the novel coronavirus pandemic, the Office of Management

In its immediate responseto the COVID-19 pandemic,
the U.S. Navy increased
its available bandwidth
for remote users by 150
percent to 250,0003.

and Budget (OMB) made an unprecedented call1 for agencies to maximize
telework flexibilities, resulting in 98 percent of the federal workforce
working remotely 2. This abrupt and wide-scale shift to a remote work
environment required agency security teams to adjust with little to noplanning, placed a tremendous strain on all aspects of security operations,and intensified risk beyond the norm for federal infrastructure.
In some ways, this shift merely accelerated modernization initiatives thatwere already underway. But what wasonce a slow and segmented approach totelework prior to the pandemic quickly
leaped forward to require support for
critical internal government functions
such as sensitive communications,acquisition activities, and essential citizen services.
One of the greatest and universal
challenges of security and complianceis securing endpoints. This becomes
particularly difficult in a teleworkenvironment where there is less visibility and control. There are indicatorsof compromise specific to remote environments that security personnel must
be aware of, such as an unusually slow
computer, pop-ups that don’t seem toadhere to browser rules, the loss of USB
port use, or mouse/keyboard locks up.
Remote environments are particularly
vulnerable to SMBv3 Client/Server
Remote Code Execution Vulnerability,
Scripting Engine Memory Corruption
Vulnerability (IE Flaw - Remote Exec),
and other Zero-Day malicious code
drops or executions.

FOUNDATIONAL CONTROLS FORSECURITY, COMPLIANCE & IT OPERATIONSThe Role of Frameworks
So, how do agencies secure theseremote endpoints? Security teams canand should turn to commonly referenced
security standards and frameworks forcybersecurity best practices and effective guidance on the methods necessary
to ensure security and compliance. At
a minimum, agency personnel shouldreference compliance requirements as
identified in FISMA, HIPAA, or CMMC, aswell as department- and agency-specificpolicies. These are by nature required
and thus something that must be tackled
immediately.
There are commonly referenced security frameworks such as the NIST CSF,
NIST 800 series publications and the CIS
Controls, which provide a more holistic
approach to cybersecurity across theagency, and to which many compliancerequirements align. Additionally, telework-specific guidelines have beenreleased by CISA in TIC 3.0 Interim
Telework Guidance. For example, within
its universal security capabilities list
we see controls such as configuration
management, vulnerability assessment, dynamic threat detection, strong
authentication, backup and recovery ofdata, etc.
Specific to the home environment, CIS
provides its CIS Controls Telework andSmall Office Network Security Guide
which includes guidelines for securing
small office and home office environments, such as how to properly set
up devices, networks and encryption
standards that each federal worker canapply to his/her home environment.
Given these available frameworks, we
already have a rich body of guidance
available to assist us in properly securing remote endpoints for any enterprise.
That being said, properly securing
remote environments is less about doing
something fundamentally different, andmore about doing the same essential
security basics in different environments—with a focus on doing thosebasics well. In order to prioritize theseefforts, we need to focus our attention on the most basic controls: asset

inventory, secure configuration management, vulnerability management, auditlogging, and change control.
How then do we successfully implement
these controls and properly secure
remote points for federal employees ina maximum telework situation, given
the constraints presented in homeenvironments? The good news is thatthe following technical constraints don’t
have to preclude the security of remote
endpoints when using the right tools.

Technical Constraints» Lack of security diversity: Am I reallysecure?

» VPN will not connect, or drops
connection: Have we considered how
well our VPN network can scale?
Remote traffic loads? Would splittunnel VPNs reduce loads?

About the NIST CSF
In understanding the role of security frameworks, we can view theNIST Cybersecurity Framework(CSF) as a kind of an organizing
framework for security strategy
at the enterprise level. Then, we
can view the NIST 800 series
publications, i.e. 800-53, as aseries of detailed technical standards. The CIS Controls in many
ways serve at the operational
level under which technical specific sub-controls and technicalstandards are grouped, and inturn can be mapped to the NIST
CSF. This set (and others) ofstandards and frameworks have
proven to be effective in ensuring
security and compliance.

» Security software requires secure
encrypted VPN connection: Are webeing shortsighted and thinking VPN
access was all we needed for remotesecurity hygiene?

» No alternative connection options tomeet the remote security needs ofmy agency: Can your tools utilize aSOCKS5 proxy as many webservers in
the DMZ do?

How Tripwire Helps
The following Tripwire solutions run
with an agent on the client and are able
to connect to the management console
by SOCKS5 Proxy, meaning they don’t
require VPN connectivity. So even if
an agency’s VPN is completely disconnected, rest assured Tripwire security
software is still doing its job and still
forwarding information up to agency
servers—offering premium endpoint
protection for remote federal enterpriseenvironments.

Tripwire® Enterprise
Tripwire provides cybercrime controls,change detection, and secure configuration management via file integrity
management and system integrity management. tripwire.me/TE

Tripwire Log Center™
Tripwire provides a client that collects
logs in a lossless fashion in real time on
an agency endpoint. So if the endpoint
periodically doesn’t have connectivity
back to the agency infrastructure, itwill cache the log data and throttle it
up once it has reestablished a secure
TCP connection that can use a SOCKS5
proxy. tripwire.me/TLC

Tripwire IP360
Tripwire’s vulnerability management
solution has a client on the endpoint thatcan run scheduled (disconnected) fullvulnerability scans 24 hours/day andthen forward that information up to thevulnerability network manager at agency
headquarters.
Regardless of the duration of the COVID19 pandemic’s impact, it is very likelythat telework will become a constant,involuntary arrangement for much of thefederal workforce. With this in mind, it
is important to understand the security
impacts and to deploy solutions that
help agencies overcome VPN hurdles
and ensure the highest standard ofsecurity monitoring. tripwire.me/IP360

SOURCES
1 https://www.whitehouse.gov/wp-content/
uploads/2020/03/M-20-13.pdf
2 https://federalnewsnetwork.com/wp-content/
uploads/2020/05/050120_FNNtelework_survey_
results_FINAL.pdf
3 https://www.defense.gov/Explore/News/Article/
Article/2147123/growth-in-dod-telework-capability-may-outlive-coronavirus-pandemic/

Tripwire is the trusted leader for establishing a strong cybersecurity foundation. We protect the world’sleading organizations against the most damaging cyberattacks, keeping pace with rapidly changing techcomplexities to defend against ever-evolving threats for more than 20 years. On-site and in the cloud, ourdiverse portfolio of solutions find, monitor and mitigate risks to organizations’ digital infrastructure—all
without disrupting day-to-day operations or productivity. Think of us as the invisible line that keeps
systems safe. Learn more at tripwire.com
The State of Security: News, trends and insights at tripwire.com/blog
Connect with us on LinkedIn, Twitter and Facebook©2020 Tripwire, Inc. Tripwire, Log Center/LogCenter, IP360, Tripwire Axon and others are trademarks or registered trademarks of Tripwire, Inc. All other product and company
names are property of their respective owners. All rights reserved.
SBSCRFW1b2006