Special Publication 800-46 

Version 2 (Draft) 

User’s Guide to Securing 

External Devices for Telework 

and Remote Access (DRAFT) 

Recommendations of the National Institute 

of Standards and Technology 

Karen Scarfone 

Murugiah Souppaya 
User’s Guide to Securing External 

Devices for Telework and Remote Access 

(Draft) 

Recommendations of the National 

Institute of Standards and Technology 

Karen Scarfone 

Murugiah Souppaya 

NIST Special Publication 800-46 

Version 2 (Draft) 

C O M P U T E R S E C U R I T Y

Computer Security Division 

Information Technology Laboratory 

National Institute of Standards and Technology 

Gaithersburg, MD 20899-8930 

May 2007 

U.S. Department of Commerce 

Carlos M. Gutierrez, Secretary 

Technology Administration 

Robert C. Cresanti, Under Secretary of Commerce for 

Technology 

National Institute of Standards and Technology

William Jeffrey, Director 
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Reports on Computer Systems Technology 

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology 

(NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s 

measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of 

concept implementations, and technical analysis to advance the development and productive use of 

information technology. ITL’s responsibilities include the development of technical, physical, 

administrative, and management standards and guidelines for the cost-effective security and privacy of 

sensitive unclassified information in Federal computer systems. This Special Publication 800-series 

reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative 

activities with industry, government, and academic organizations. 

Certain commercial entities, equipment, or materials may be identified in this 

document in order to describe an experimental procedure or concept adequately. 

Such identification is not intended to imply recommendation or endorsement by the 

National Institute of Standards and Technology, nor is it intended to imply that the 

entities, materials, or equipment are necessarily the best available for the purpose. 

National Institute of Standards and Technology Special Publication 800-46 Version 2 (Draft) 

Natl. Inst. Stand. Technol. Spec. Publ. 800-46 Ver. 2, 44 pages (May 2007) 

ii
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Acknowledgements 

The authors, Karen Scarfone and Murugiah Souppaya of the National Institute of Standards and 

Technology (NIST), wish to thank their colleagues who reviewed drafts of this document and contributed 

to its technical content. The authors would like to acknowledge Tim Grance and Rick Kuhn of NIST and 

Derrick Dicoi and Victoria Thompson of Booz Allen Hamilton for their keen and insightful assistance 

throughout the development of the document. Additional acknowledgements will be added to the final 

version of the publication. 

iii
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Table of Contents 

Executive Summary..............................................................................................................ES-1

1. Introduction ......................................................................................................................1-1

1.1 Authority...................................................................................................................1-1

1.2 Purpose and Scope .................................................................................................1-1

1.3 Audience..................................................................................................................1-1

1.4 Document Structure .................................................................................................1-1

2. Overview of Telework Technologies..............................................................................2-1

2.1 Remote Access Methods .........................................................................................2-1

2.2 Telework Devices.....................................................................................................2-2

2.3 Telework Device Security Overview ........................................................................2-3

3. Securing Information.......................................................................................................3-1

4. Securing Home Networks and Using External Networks.............................................4-1

4.1 Wired Home Networks .............................................................................................4-1

4.2 Wireless Home Networks.........................................................................................4-2

4.3 External Networks....................................................................................................4-3

5. Securing Telework PCs ...................................................................................................5-1

5.1 Software Updates ....................................................................................................5-1

5.2 User Accounts and Sessions ...................................................................................5-1

5.2.1 Use Accounts with Limited Privileges...........................................................5-2

5.2.2 Protect Accounts with Passwords ................................................................5-2

5.2.3 Protect User Sessions From Unauthorized Physical Access .......................5-3

5.3 Networking Configuration.........................................................................................5-3

5.3.1 Disable Unneeded Networking Features......................................................5-3

5.3.2 Limit the Use of Remote Access Utilities......................................................5-4

5.3.3 Configure Wireless Networking ....................................................................5-4

5.4 Attack Prevention.....................................................................................................5-4

5.4.1 Install and Configure Antivirus and Antispyware Software ...........................5-4

5.4.2 Use Personal Firewalls.................................................................................5-5

5.4.3 Enable and Configure Content Filtering Software ........................................5-7

5.5 Major Application Configuration ...............................................................................5-8

5.5.1 Web Browsers ..............................................................................................5-8

5.5.2 Email Clients.................................................................................................5-9

5.5.3 Instant Messaging Clients ..........................................................................5-10

5.5.4 Office Productivity Suites............................................................................5-10

5.6 Remote Access Software Configuration ................................................................5-11

5.7 Security Maintenance and Monitoring....................................................................5-11

5.8 For More Information .............................................................................................5-12

6. Securing Telework Consumer Devices..........................................................................6-1

7. Assessing the Security of Third-Party Devices ............................................................7-1

7.1 Security of PCs ........................................................................................................7-1

7.2 Security of Consumer Devices.................................................................................7-2

iv
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

List of Appendices 

Appendix A— Additional Security Considerations for Telework ....................................... A-1

A.1 Phone Services....................................................................................................... A-1

A.2 WPAN Technologies............................................................................................... A-1

A.3 Wireless Broadband Data Network Technologies .................................................. A-2

A.4 Information Destruction........................................................................................... A-2

Appendix B— Glossary .......................................................................................................... B-1

Appendix C— Acronyms........................................................................................................ C-1

Appendix D— Resources ....................................................................................................... D-1

List of Tables 

Table 5-1. Mapping to Windows XP Guidance .......................................................................5-13

v
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Executive Summary 

Many people telework (also known as telecommuting), which is the ability for an organization’s 

employees and contractors to conduct work from locations other than the organization’s facilities. 

Teleworkers use various devices, such as desktop and laptop computers, cell phones, and personal digital 

assistants (PDA), to read and send email, access Web sites, review and edit documents, and perform many 

other tasks. Most teleworkers use remote access, which is the ability of an organization’s users to access 

its nonpublic computing resources from locations other than the organization’s facilities. Organizations 

have many options for providing remote access, including virtual private networks, remote system 

control, and individual application access (e.g., Web-based email). 

Telework devices can be divided into two categories: personal computers and consumer devices (e.g., cell 

phones, PDAs, video game systems). Each telework device is owned by the organization or an external 

entity, either a teleworker or a third party. This publication provides recommendations for securing 

external devices used for telework and remote access. Many organizations limit the types of external 

devices that can be used for remote access and which resources they can use, such as permitting 

teleworker-owned laptops to access a limited set of resources and permitting all other external devices to 

access Web-based email only. This allows organizations to limit the risk they incur from external 

devices. When a telework device uses remote access, it is essentially a logical extension of the 

organization’s own network. Therefore, if the telework device is not secured properly, it poses additional 

risk to not only the information that the teleworker accesses but also the organization’s other systems and 

networks. For example, a telework device infected with a worm could spread the worm through remote 

access to the organization’s internal computers. Therefore, telework devices should be secured properly 

and have their security maintained regularly. 

Implementing the following recommendations should help teleworkers improve the security of their 

telework devices. 

Before teleworking, users should understand not only their organization’s policies and 

requirements but also appropriate ways of protecting the organization’s information that they may 

access. 

Sensitive information that is stored on or sent to or from external telework devices needs to be protected 

so that malicious parties can neither access nor alter information. An unauthorized release of sensitive 

information could damage the public’s trust in an organization, jeopardize the mission of an organization, 

or harm individuals if their personal information has been released. Understanding how to protect such 

information accessed during telework can be confusing because there are many ways in which 

information can be protected. Examples include protecting the physical security of telework devices, 

encrypting files stored on devices, and ensuring that information stored on devices is backed up. 

Teleworkers should ensure that all the devices on their wired and wireless home networks are 

properly secured. 

An important part of telework and remote access security is applying security measures to the wired and 

wireless home networks to which the telework device normally connects. A major component of home 

network security is securing other PCs and consumer devices on the home network. If any of these 

devices become infected with malware or are otherwise compromised, they could potentially attack the 

telework device or eavesdrop on its communications. Teleworkers should also be cautious about 

allowing others to place devices on the teleworkers’ home networks, in case one of these devices is 

compromised. 

ES-1 
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Teleworkers who use their own desktop or laptop personal computers (PC) for telework should 

secure their operating systems and major applications. 

Securing a telework PC includes the following actions: 

 Using a combination of security software, such as antivirus and antispyware software, personal 

firewalls, spam and Web content filtering, and popup blocking, to stop most attacks, particularly 

malware 

 Restricting who can use the PC by having a separate standard user account for each person, assigning 

a password to each user account, using the standard user accounts for daily use, and protecting user 

sessions from unauthorized physical access 

 Ensuring that updates are regularly applied to the operating system and major applications, such as 

Web browsers, email clients, instant messaging clients, and security software 

 Disabling unneeded networking features and configuring wireless networking securely 

 Configuring major applications to filter content and stop other activity that is likely to be malicious 

 Installing and using only known and trusted software 

 Configuring remote access software based on the organization’s requirements and recommendations 

 Maintaining the PC’s security on an ongoing basis, such as changing passwords regularly and 

checking the status of security software periodically. 

Teleworkers who use their own consumer devices for telework should secure them based on the 

security recommendations from the devices’ vendors. 

A wide variety of consumer devices exists, and security features available for these devices also vary 

widely. Some devices offer only a few basic features, whereas others offer sophisticated features similar 

to those offered by PCs. This does not necessarily imply that more security features are better; in fact, 

many devices offer more security features because the capabilities they provide (e.g., wireless 

networking, instant messaging) make them more susceptible to attack than devices without these 

capabilities. General recommendations for securing telework devices are as follows: 

 Limit access to the device, such as setting a personal identification number (PIN) or password and 

automatically locking a device after an idle period. 

 Disable networking capabilities, such as Bluetooth, except when they are needed. 

 Use additional security software, such as antivirus software and personal firewalls, if appropriate. 

 Ensure that security updates, if available, are acquired and installed at least monthly. 

 Configure applications to support security (e.g., blocking activity that is likely to be malicious). 

Teleworkers should assess the security state of a third-party device before using it for telework. 

Teleworkers often want to perform remote access from third-party devices, such as checking email from a 

kiosk computer at a conference. However, teleworkers typically do not know if such devices have been 

secured properly. Consequently, a teleworker could use a device infected with malware that steals 

information from users (e.g., passwords or email messages). Many organizations either forbid third-party 

devices to be used for remote access or permit only limited use, such as for Web-based email. A 

ES-2 
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

teleworker’s ability to assess the security state of a device depends on several factors; however, it is 

usually much more difficult to determine the security state of a consumer device than a PC. 

 

ES-3 
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

1. Introduction 

1.1 Authority 

The National Institute of Standards and Technology (NIST) developed this document in furtherance of its 

statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, 

Public Law 107-347. 

NIST is responsible for developing standards and guidelines, including minimum requirements, for 

providing adequate information security for all agency operations and assets; but such standards and 

guidelines shall not apply to national security systems. This guideline is consistent with the requirements 

of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), “Securing Agency 

Information Systems,” as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental 

information is provided in A-130, Appendix III. 

This guideline has been prepared for use by Federal agencies. It may be used by nongovernmental 

organizations on a voluntary basis and is not subject to copyright, though attribution is desired. 

Nothing in this document should be taken to contradict standards and guidelines made mandatory and 

binding on Federal agencies by the Secretary of Commerce under statutory authority, nor should these 

guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, 

Director of the OMB, or any other Federal official. 

1.2 Purpose and Scope 

This publication helps teleworkers secure the external devices they use for telework, such as personally 

owned and privately owned desktop and laptop computers and consumer devices (e.g., cell phones, 

personal digital assistants [PDA]). The document focuses specifically on security for telework involving 

remote access to their organizations’ nonpublic computing resources. It provides practical, real-world 

guidance on securing telework computers’ operating systems (OS) and applications, as well as home 

networks that the computers use. It presents basic recommendations for securing consumer devices used 

for telework. The document also presents guidance on protecting the information stored on telework 

computers and removable media. In addition, it provides tips on assessing the security of a device owned 

by a third party before deciding whether it should be used for telework. 

1.3 Audience 

This document has been created primarily for teleworkers who are responsible for securing the external 

devices that they use for telework. The document also should be helpful to information security 

personnel and others who may need to assist teleworkers with their devices and remote access use. 

1.4 Document Structure 

The remainder of this document is organized into six major sections: 

 Section 2 provides an overview of telework and remote access and an introduction to security 

concerns regarding telework devices. 

 Section 3 provides guidance on securing information stored on or sent to or from external telework 

devices. 

1-1
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

 Section 4 presents recommendations for securing wired and wireless home networks used for 

telework. 

 Section 5 discusses securing personal computers (PC) that are used for telework through methods 

such as applying software updates and installing and configuring antivirus software and personal 

firewalls. 

 Section 6 gives an overview of securing consumer devices that are used for telework. 

 Section 7 discusses information that teleworkers should keep in mind before using a device secured 

by a third party, such as a computer provided for public use at a conference or hotel. 

The document also contains several appendices with supporting material: 

 Appendix A presents additional security-related considerations for telework, such as using phone 

services (e.g., cellular phones, Voice over IP services [VoIP]), using wireless personal area network 

(WLAN) technologies such as Bluetooth, using wireless broadband data cards, and ensuring the 

secure destruction of removable media and printed materials that might contain sensitive information. 

 Appendices B and C contain a glossary and acronym list, respectively. 

 Appendix D lists print resources and online tools and resources that may be helpful references for 

securing telework devices. 

This document is intended to be used by readers with various levels of experience and security 

knowledge, who are faced with different situations in securing their telework devices. For example, one 

reader might be securing a home network and a laptop, while another reader wants to secure a cell phone. 

Not all sections of this guide will apply to every situation. 

Users should back up all data and verify the validity of the backups before implementing any of the 

recommendations or suggestions in the guide. Readers with little or no experience configuring 

personal computers, consumer devices, or home networks should seek assistance in applying the 

recommendations. Every telework device’s existing configuration and environment is unique, so 

changing its configuration could have unforeseen consequences, including loss of data and loss of 

device or application functionality.

1-2
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

2. Overview of Telework Technologies 

Many people telework (also known as telecommuting), which is the ability for an organization’s 

employees and contractors to perform work from locations other than the organization’s facilities. 

Teleworkers use various devices, such as desktop and laptop computers, cell phones, and PDAs, to read 

and send email, access Web sites, review and edit documents, and perform many other tasks. Most 

teleworkers use remote access, which is the ability for an organization’s users to access its nonpublic 

computing resources from locations other than the organization’s facilities. For many years, dial-up 

modems were the primary communications mechanism for remote access, but their slow speeds severely 

limited what teleworkers could do. The increased availability of high-speed Internet connectivity has 

allowed for greatly expanded use of remote access. 

This section of the publication provides an overview of telework technologies. It discusses commonly 

used remote access methods and talks about the need to secure telework devices such as laptops and 

PDAs. 

2.1 Remote Access Methods 

Organizations have many options for providing remote access to their computing resources. The options 

most commonly used for teleworkers are as follows: 

 Virtual private network (VPN). A VPN is a “tunnel” that connects the teleworker’s computer to the 

organization’s network. Once the tunnel has been established, the teleworker can access many of the 

organization’s computing resources through the tunnel. The types of VPNs most commonly used for 

teleworkers are as follows: 

– Internet Protocol Security (IPsec) VPN. An IPsec VPN can give teleworkers access to 

many different types of resources, such as applications, file servers, and printers. Using an 

IPsec VPN requires IPsec client software to be installed and configured on each telework 

device. Several applications, such as a word processor for viewing and editing documents, 

also may need to be installed. Because of the software installation and configuration needs, 

IPsec VPNs are most often accessed from computers issued and controlled by the 

organization. Some organizations permit teleworkers to install IPsec VPN clients on their 

own PCs. The client software is often preconfigured by the organization and provided to the 

teleworkers; otherwise, teleworkers can configure IPsec VPN clients built into their PCs or 

acquire, install, and configure third-party clients. 

– Secure Sockets Layer (SSL) VPN. An SSL VPN primarily provides access to Web-based 

applications; some also provide access to other types of applications. SSL VPNs are 

designed to be accessed through standard Web browsers; therefore, on most computers and 

most consumer devices, there is no need to install additional software. However, teleworkers 

may need to install browser plug-ins or other additional software that the organization 

provides for accessing particular applications. 

 Remote system control. Remote system control allows a teleworker to remotely use a computer at 

the organization from a telework computer. The remote computer has the software installed that the 

teleworker needs to run, such as office productivity software (e.g., word processors, spreadsheet 

programs) and organization-specific applications. The remote system control method most 

commonly used for telework is terminal server access, which gives each teleworker access to a 

2-1
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

separate standard virtual desktop.1

 Terminal server access requires the teleworker to either install a 

special client application on the telework computer or use a Web-based interface, often with a 

browser plug-in or other additional software that the organization provides. 

 Individual application access. A teleworker can access an individual application remotely, usually a 

Web-based application such as email access. This type of access typically requires only a Web 

browser on the telework device, so in most cases there is no need to reconfigure the device or install 

software on it before accessing the applications. 

There are many ways in which teleworkers gain access to the Internet, including broadband networks 

(e.g., cable modem, digital subscriber line [DSL], satellite, and wireless broadband), wireless hotspots, 

other organizations’ networks, and dial-up access to Internet service providers (ISP). For this publication, 

the method used is typically irrelevant; any special considerations related to a particular method are 

highlighted. 

Some organizations have pools of modems that teleworkers can dial to directly access the organization’s 

computing resources, instead of accessing the resources over the Internet. For example, an organization 

might have a toll-free number that users on travel can call from their laptops to get access to email. As 

high-speed Internet access has become widely available, the need for organization-hosted modem pools 

has decreased. 

Most of the computing resources used through remote access are available only to an organization’s users. 

Before accessing such resources, the users need to demonstrate their identities, such as with usernames 

and passwords. Many remote access solutions require teleworkers to authenticate multiple times; for 

example, a teleworker might need to authenticate to use a VPN, and then authenticate to individual 

applications accessed through the VPN. Many organizations have separate authentication systems for 

remote access, and it is common for teleworkers to be issued a hardware token and to have to enter a code 

from the token into the computer to be authenticated. Many organizations also require teleworkers to 

reauthenticate periodically during long remote access sessions, such as after each 4 hours of a session or 

after 30 minutes of idle time. These authentication options help organizations confirm that the person 

using remote access is authorized to do so. 

Most remote access technologies and many individual applications are able to encrypt their 

communications automatically. This ability prevents attackers on the Internet and other networks from 

eavesdropping on the communications or tampering with them. It is outside the scope of this publication 

to provide a detailed explanation of communications protection. Teleworkers should check with their 

organizations as to what protection is applied to their communications, so that they do not inadvertently 

transfer sensitive information over networks without adequate protection. 

2.2 Telework Devices 

Telework devices can be divided into two categories: 

 Personal computers (PC), which are desktop and laptop computers running standard PC OSs (e.g., 

Windows Vista, Windows XP, Linux/UNIX, and Mac OS X). PCs can be used for any of the remote 

access methods described in Section 2.1. 

 

1

 A less commonly used method is remote desktop access, which gives a teleworker access to a particular actual desktop at 

the organization, most often the user’s own computer at the organization’s office. Remote desktop access is much more 

difficult to secure than terminal server access; therefore, many organizations do not permit remote desktop access. 

2-2
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

 Consumer devices, which are small, usually mobile computers that do not run standard PC OSs. 

Examples of consumer devices are networking-capable PDAs, cell phones, and video game systems.2

 

Consumer devices are most often used for remote access methods that use Web browsers, primarily 

SSL VPNs and individual Web application access. 

Where applicable, this publication provides recommendations specific to securing PCs or consumer 

devices. Another set of categories used in the recommendations is the party that owns the telework 

device. These categories are as follows: 

 Organization. Telework devices in this category are usually owned, configured, and managed by the 

organization. These devices can be used for any of the organization’s remote access methods. 

 Teleworker. These devices are owned by the teleworker, who is ultimately responsible for securing 

them and maintaining their security. These devices can usually be used for many or all of the 

organization’s remote access methods. 

 Third party. These devices are owned, configured, and secured by third parties, such as kiosk 

computers at hotels, and PCs or consumer devices owned by friends and family. Remote access 

options for third party-secured devices are typically quite limited because users cannot or should not 

install software onto them, such as VPN software, terminal server software, and Web browser plugins. 

For various reasons, including security policies and technology limitations, organizations often limit 

which types of devices can be used for remote access. For example, an organization might permit only 

organization-owned PCs to be used. Some organizations have tiered access levels, such as allowing 

organization-owned PCs to access many resources, teleworker-owned PCs to access a limited set of 

resources, and consumer devices and third-party PCs to access only one or two resources, such as Webbased email. This allows an organization to limit the risk it incurs by permitting the most-controlled 

devices to have the most access and the least-controlled devices to have minimal access. Before using 

remote access, each teleworker should check with his or her organization to confirm that the organization 

permits the teleworker’s PCs and/or consumer devices to be used for remote access. 

2.3 Telework Device Security Overview 

In today’s computing environment, there are many threats to telework devices. These threats are posed 

by people with many different motivations, including causing mischief and disruption, committing fraud, 

and performing identity theft. Teleworkers can increase their devices’ security to provide better 

protection against these threats. The primary threat against most telework devices is malware. Malware, 

also known as malicious code, refers to a computer program that is covertly placed onto a computing 

device with the intent of compromising the confidentiality, integrity, or availability of the device’s data, 

applications, or OS. Common types of malware threats include viruses, worms, malicious mobile code, 

Trojan horses, rootkits, and spyware. Malware threats can infect devices through many means, including 

email, Web sites, file downloads and file sharing, peer-to-peer software, and instant messaging. Another 

common threat against telework devices is the loss or theft of the device. Someone with physical access 

to a device has many options for attempting to view the information stored on it. 

Security protections, also known as security controls, are measures against threats that are intended to 

compensate for the device’s security weaknesses, also known as vulnerabilities. Threats attempt to take 

advantage of these vulnerabilities. Some vulnerabilities can be eliminated through security protections, 

 

2

 Technically, some video game systems do run standard PC operating systems, but these are often hidden and are not 

intended for users to use directly. 

2-3
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

such as a feature in an application that automatically downloads and installs new versions of the 

application that have corrected previous errors. For vulnerabilities that cannot be eliminated, security 

protections can prevent attacks from taking advantage of them, such as antivirus software stopping an 

infected email from being opened by a user, or hard drive encryption making files unreadable by others. 

Regardless of how many security protections are used, it is simply impossible to provide 100-percent 

protection against attacks because of the complexity of computing. A more realistic goal is to use 

security protections to give attackers as few opportunities as feasible to gain access to a device or to 

damage the device’s software or information. 

For an organization, permitting teleworkers to remotely access its computing resources gives attackers 

additional opportunities to breach the organization’s security. When a telework device uses remote 

access, it is essentially an extension of the organization’s own network. Therefore, if the telework device 

is not secured properly, it poses additional risk to not only the information that the teleworker accesses 

but also the organization’s other systems and networks. For example, a telework device infected with a 

worm could spread it through remote access to the organization’s internal computers. Therefore, telework 

devices should be secured properly and have their security maintained regularly. 

Many organizations automatically check the security health of each telework device that attempts to use 

remote access to ensure that it complies with the organization’s policies. Examples of the checks are 

verifying that the OS is fully patched, antivirus software is installed and up-to-date, and a personal 

firewall is enabled. Some remote access solutions can also determine if the device is organization secured 

and what type of device it is (e.g., desktop/laptop, PDA, video game system). Based on the results of 

these checks, the organization can determine whether the device should be permitted to use remote 

access. 

The remainder of this publication provides guidance for securing telework devices. The 

recommendations address securing PCs and consumer devices, securing the networks that telework 

devices use, and protecting information stored on and sent to and from telework devices. This publication 

also provides guidance on evaluating the security of third party-owned devices, so that teleworkers can 

decide whether the devices should be used for remote access. 

2-4
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

3. Securing Information 

Sensitive information, such as personally identifiable information (PII) (e.g., personnel records, medical 

records, financial records)3

 that is stored on or sent to or from telework devices needs to be protected so 

that malicious parties cannot access or alter it. An unauthorized release of sensitive information could 

damage the public’s trust in an organization, jeopardize the organization’s mission, or harm individuals if 

their personal information has been released. 

Before teleworking, users should understand their organization’s policies and requirements and the 

appropriate ways of protecting the organization’s information. This can be confusing because there are 

many ways in which information can be protected. Examples of methods that organizations may expect 

or require teleworkers to use are as follows: 

 Using physical security controls for telework devices and removable media. For example, an 

organization might require that laptops be physically secured using cable locks when used in hotels, 

conferences, and other locations where third parties could easily gain physical access to the devices. 

 Encrypting files stored on telework devices and removable media such as CDs and flash drives. 

This prevents attackers from gaining access to information in the files. Many options exist for 

protecting files, including encrypting individual files or folders, volumes, and hard drives. 

 Ensuring that information stored on telework devices is backed up. If something adverse 

happens to a device, such as a hardware, software, or power failure or a natural disaster, the 

information on the device will be lost unless it has been backed up to another device or removable 

media. Some organizations permit teleworkers to back up their local files to a centralized system 

(e.g., through VPN remote access), whereas other organizations recommend that their teleworkers 

perform local backups (e.g., burning CDs, copying files onto removable media). Teleworkers should 

perform backups, following their organizations’ guidelines, and verify that the backups are valid and 

complete. It is important that backups on removable media be secured at least as well as the device 

that they backed up; for example, if a computer is stored in a locked room, then the media also should 

be in a secured location; if a computer stores its data encrypted, then the backups of that data should 

also encrypt the data. 

 Ensuring that information is removed from devices when it is no longer needed. For example, 

the organization’s files should be removed from a computer scheduled to be retired or a third-party 

computer that is temporarily used for remote access. Some remote access methods perform basic 

information cleanup, such as clearing Web browser caches that might inadvertently hold sensitive 

information, but more extensive cleanup typically requires using a special utility, such as a disk 

scrubbing program specifically designed to remove all traces of information from a device. Many 

organizations offer their teleworkers assistance in removing information from personally owned 

devices. 

 Erasing data from missing cell phones and PDAs. If a cell phone or PDA is lost or stolen, 

occasionally its contents can be erased remotely. This prevents an attacker from obtaining any 

 

3

 OMB Memorandum 06-19, Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost 

for Security in Agency Information Technology Investments, defines PII as “any information about an individual maintained 

by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment 

history and information which can be used to distinguish or trace an individual's identity, such as their name, social security

number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information 

which is linked or linkable to an individual.” The full text of the memorandum is available at 

http://www.whitehouse.gov/omb/memoranda/fy2006/m-06-19.pdf. 

3-1
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

information from the device. The availability of this service depends on the capabilities of the 

product and the company providing network services for the product. 

Each situation may require a different combination of protection options: for example, an organization 

might require one combination for IPsec VPN access from teleworker-owned computers and another 

combination for access to an individual application from third party-secured devices. Teleworkers should 

follow their organizations’ requirements and recommendations for protecting sensitive information 

accessed with telework devices. Some organizations use the same requirements and recommendations for 

all types of information because of the difficulties in differentiating sensitive and nonsensitive 

information. 

Teleworkers also need to ensure that they adequately protect their remote access-specific authenticators, 

such as passwords, personal identification numbers (PIN), and hardware tokens. Such authenticators 

should not be stored with the telework computer, nor should multiple authenticators be stored with each 

other (e.g., a password or PIN should not be written on the back of a hardware token). 

Teleworkers should also be aware of how to handle threats involving social engineering, which is a 

general term for attackers trying to trick people into revealing sensitive information or performing certain 

actions, such as downloading and executing files that appear to be benign but are actually malicious. For 

example, an attacker might approach a teleworker in a coffee shop and ask to use the computer for a 

minute or offer to help the teleworker with using the computer. Teleworkers should be wary of any 

requests they receive that could lead to a security breach or the theft of a telework device. 

3-2
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

4. Securing Home Networks and Using External Networks 

An important part of telework and remote access security is applying security measures to the home 

networks to which the telework device normally connects.4

 A major component of home network 

security is securing other PCs and consumer devices on the home network. If any of these devices 

become infected with malware or are otherwise compromised, they could potentially attack the telework 

device or eavesdrop on its communications. Consequently, teleworkers should ensure that all devices on 

their home networks are secured properly. Teleworkers should also be cautious about allowing others to 

place devices on the teleworkers’ wired and wireless home networks, in case one of these devices has 

been or will be compromised. 

Sections 4.1 and 4.2 present recommendations for securing wired and wireless home networks, 

respectively. Section 4.3 briefly discusses the security implications of performing telework from external 

networks. 

4.1 Wired Home Networks 

Teleworkers should secure their wired home networks to help protect their telework devices. The most 

important part of securing most wired home networks is separating the home network from the network’s 

ISP as much as possible. If a telework device connects directly to the teleworker’s ISP, such as plugging 

the device directly into a cable modem, then the device is directly accessible from the Internet and at high 

risk of being attacked. To prevent this from occurring, the home network should have a security device 

between the ISP and the telework device. This is most commonly accomplished by using a broadband 

router (e.g., cable modem router, DSL router) or a firewall appliance.5

This security device should be configured to use a feature known as network address translation (NAT),6

which can prevent computers on the Internet from directly accessing any of the devices on the home 

network, including the telework device.7

 Even if each device uses a personal firewall, a firewall 

appliance or broadband router should also be used to provide an additional layer of security. For 

example, if a personal firewall on a computer malfunctioned, the appliance or router would still protect 

the computer from unauthorized network communications from external computers. In some cases, the 

appliance or router also can protect devices on the home network from each other—if the devices are 

logically separated by the appliance or router. For example, a router that has both wired and wireless 

interfaces might be able to prevent the spread of certain types of malware from a device on the wireless 

network to a device on the wired network, depending on the router’s capabilities and configuration. 

When installing and configuring firewall appliances or broadband routers, teleworkers should perform the 

security precautions described in the vendor’s documentation. The following are some examples of 

possible precautions: 

 Changing default passwords on the device so that attackers cannot use them to gain access to the 

device (lists of default passwords are widely available on the Internet) 

 

4

 Some telework devices, such as cell phones and laptops with wireless broadband network cards, do not use home networks. 5

 A firewall appliance should not be confused with a personal firewall, which is software based; a firewall appliance is a 

separate physical device. 6

 NAT translates the external, public Internet Protocol (IP) address assigned by the ISP into multiple internal private IP 

addresses. This not only prevents the devices from being accessed from external computers (because the home networks’ 

computers have non-public addresses) but also allows the home network to share a single public IP address from the ISP, 

even though multiple devices may exist on the home network. NAT provides stronger security and, in some cases, a cost 

savings for consumers (many ISPs charge fees for multiple IP addresses), so home networks should use it if the teleworkers’ 

ISPs permit its use. 7

 NAT is recommended as an additional security measure, and is not intended to take the place of a firewall. 

4-1
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

 Configuring the device so that it cannot be administered from outside the home network, preventing 

external attackers from taking control of the device 

 Configuring the device to silently ignore unsolicited requests sent to it, which essentially hides the 

device from malicious parties 

 Checking for updates and applying them periodically, as explained in the vendor’s documentation—

either automatically (typically daily or weekly) or manually (to be performed by the teleworker at 

least monthly) 

 For broadband routers, turning off or disabling built-in wireless access points (AP) that are not being 

used. 

The proper precautionary measures for a firewall appliance or broadband router vary greatly from device 

to device, so some or all of these options may not be applicable to many devices. 

4.2 Wireless Home Networks 

Wireless networking transfers information through the air between a telework device and a wireless AP.8

 

If improperly configured, a wireless home network will transmit sensitive information without adequate 

protection, exposing it to other wireless devices in close proximity. Accordingly, teleworkers should 

secure their wireless home networks so that their remote access communications are protected. 

Teleworkers should follow the security recommendations from the documentation for the home network’s 

wireless AP. Assuming that the network is using Institute of Electrical and Electronics Engineers (IEEE) 

802.11 protocols (e.g., 802.11a/b/g/n), the following are examples of common security recommendations: 

 Use a wired equivalent privacy (WEP) key. A WEP key is a series of characters (either a password 

composed of letters, digits, and punctuation, or a long hexadecimal number) that is used to limit 

access to a wireless network.9

 A wireless AP can be configured to require each device to provide the 

same WEP key as the one stored in the AP. Devices that do not know the WEP key cannot use the 

wireless network. The WEP key should be long and complex, making it difficult for others to guess. 

This should help to prevent people near the AP from gaining unauthorized access to the network.

 Use strong encryption to protect communications. An industry group called the Wi-Fi Alliance 

has created a series of product security certifications called Wi-Fi Protected Access (WPA), which 

include the WPA and WPA2 certifications. Devices with wireless network cards that support either 

WPA1 or WPA2 can use their security features, such as encrypting network communications with the 

Advanced Encryption Security (AES) algorithm. Recommended choices, in order with the most 

preferred option first, are as follows: 

1. WPA2 with AES 

2. WPA1 with AES 

3. WPA1 with Temporal Key Integrity Protocol (TKIP) 

4. WEP with 128-bit encryption. 

 Permit access for only particular wireless network cards. Some APs can be configured to allow 

only specific devices to use the wireless network. This is accomplished by identifying the media 

 

8

 A device can also wirelessly network directly with another device through what is known as an ad hoc wireless network. 

However, known security risks exist with ad hoc networks; therefore, this guide does not recommend their use. 9

 Some Microsoft products refer to a “WEP key” as a “WPA key.” 

4-2
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

access control (MAC) address of each device’s wireless network card and entering the MAC address 

into a list on the AP. Because a MAC address should be unique to a particular network interface, 

specifying its MAC address in the AP can be helpful in preventing malicious unauthorized parties 

from gaining wireless network access.10 (Consult a device’s documentation to learn how to 

determine its MAC address.) 

 Change the default service set identifier (SSID). An SSID is a name assigned to a wireless AP. 

The SSID allows people and devices to distinguish one wireless network from another. Most APs 

have a default SSID—often the vendor or product’s name. If this default SSID is not changed, and 

another nearby wireless network has the same default SSID, then the teleworker’s device might 

accidentally attempt to join the wrong wireless network.11 Changing the SSID to something 

unusual—not the default value, and not an obvious value such as “SSID” or “wireless”—makes it 

much less likely that a device will choose the wrong network. 

 Disable AP administration through wireless communications. Flaws are frequently identified in 

the administration utilities for wireless APs. If an AP has such a flaw, attackers in the vicinity could 

reconfigure it to disable its security features or use it to acquire access to the teleworker’s home 

network or the Internet. To prevent such incidents, teleworkers should configure APs so that they can 

only be administered locally—such as running a cable between a computer and the AP—and not 

administered wirelessly or otherwise remotely. 

4.3 External Networks 

Teleworkers should be aware that networks other than their home networks are unlikely to provide much 

protection for their telework devices and communications, such as a laptop using a wireless hotspot at a 

coffee shop. For example, external networks may not encrypt network communications, making them 

susceptible to eavesdropping, particularly for wireless networks. Telework devices on external networks 

are also often directly accessible from the Internet. Some networks provide partial protection, such as 

blocking specific types of communications usually associated with malicious activity and checking 

communications for the most common known threats, such as widespread worms or spam messages. 

Because there is usually no easy way for teleworkers to determine what protection an external network 

might be providing for their devices, teleworkers should assume that third-party networks are not 

providing any protection. Telework devices on third-party networks are generally at higher risk of being 

compromised than those on home networks, and their communications are also at higher risk of being 

monitored. Before using a third-party network, teleworkers should ensure that their devices are fully 

updated (see Section 5.1). The updates should be retrieved over a trusted network, such as the user’s 

home network. When teleworkers use a third-party network to access their organization’s computing 

resources, they should use a VPN or other secure remote access solution provided by the organization. 

 

10 A knowledgeable attacker can circumvent MAC address lists by configuring his or her computer to pretend to use an 

authorized MAC address. 11 If the teleworker’s access point and telework device are configured to use encryption, the telework device will fail to join 

the other wireless network because the two networks are using different encryption keys. This is another benefit of using 

encryption for wireless communications. 

4-3
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

5. Securing Telework PCs 

Teleworkers who use their own desktop or laptop PCs for telework should implement the 

recommendations presented in this section. These recommendations should be helpful in securing a PC’s 

OS and major applications. Teleworkers who do not need to secure telework PCs may skip this section. 

5.1 Software Updates 

Many threats take advantages of vulnerabilities in software on PCs. Software vendors release updates for 

their software to eliminate these vulnerabilities. Accordingly, teleworkers should ensure that updates are 

applied regularly to the major software on their telework PCs. In addition to the OS, updating should 

include the following types of software: 

 Web browsers 

 Email clients 

 Instant messaging clients 

 Antivirus software 

 Antispyware software 

 Personal firewalls. 

Teleworkers should review vendor documentation for each software program their PC contains in these 

categories to determine each program’s update capabilities. Most major software programs provide builtin mechanisms to update themselves automatically. Teleworkers should enable these features so that the 

programs check for updates at least weekly, preferably daily. For any programs that do not offer 

automatic updating, the teleworker should determine from the documentation other available options, 

such as running an update feature from the application’s menus every week or visiting the vendor’s Web 

site weekly for updates and downloading and installing any available updates. 

For a PC with slow connectivity, such as dial-up access, teleworkers should be cautious when configuring 

automatic software update features. Because many updates are very large, downloading them could 

consume all the network bandwidth on a slow link for hours at a time. This could make it difficult for 

teleworkers to send and receive email, access Web sites, and use the network in other ways while the 

download is occurring. Teleworkers could instead configure the software to download the updates at a 

time when no one needs to use the PC. 

Some software vendors offer updates at no charge, whereas others require an annual fee or other payment 

to receive updates, such as paying a subscription fee to get the latest antivirus signatures. Most software 

vendors that charge a fee allow users to pay it through the vendor’s Web site and receive updates within 

minutes of making payment. 

5.2 User Accounts and Sessions 

A PC can be configured with user accounts and passwords to restrict who can use the PC. This section 

explains how teleworkers can configure their telework PCs to prevent unauthorized access to their 

applications and data. 

5-1
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

5.2.1 

5.2.2 

Use Accounts with Limited Privileges 

On most OSs, user accounts can have full privileges or limited privileges. An account with full 

privileges, also known as an administrative account, should be used only when performing PC 

management tasks, such as installing updates and application software, managing user accounts, and 

modifying OS and application settings. If a PC is attacked while an administrative account is in use, the 

attack will be able to inflict more damage to the PC. Therefore, user accounts should be set up to have 

limited privileges; such accounts are known as daily use, limited, or standard user accounts. Teleworkers 

should not use administrative accounts for general tasks such as reading email and surfing the Web 

because such tasks are common ways of infecting PCs with malware. Malware often does more damage 

to a PC if it accesses the PC through an administrative account instead of a standard user account. 

The primary disadvantages of having separate administrative and standard user accounts are that standard 

users might not be able to run some applications, especially ones designed for older OSs, or to install 

applications and OS or application updates. This could cause a significant delay in downloading and 

installing updates, as well as making other certain tasks less convenient for users. Some OSs have a 

feature that allows a person logged in as a standard user to perform individual administrative tasks by 

selecting a particular option. 

Each person who uses the telework PC should have a separate standard user account. On most OSs, this 

keeps each person’s data and settings (e.g., files, stored emails, Web browser bookmarks and security 

settings) private from other people using the PC. It also helps limit how much damage certain attacks can 

cause, such as damaging only one user’s files, not all users’ files. 

Protect Accounts with Passwords 

Each PC user account should have a password to prevent unauthorized people from using the PC—not 

only people with physical access to the PC, but also attackers attempting to contact the PC from other 

computers. Users should select strong passwords that cannot be guessed by attackers. The following are 

recommended practices for password selection: 

 Select a sufficiently long password. Longer passwords are more difficult to guess than shorter 

passwords. The downside is that longer passwords are often more difficult for users to remember. 

Users should select passwords that are at least eight characters long. Passphrases, which are long 

passwords usually composed of multiple words, may be easier to remember than conventional 

passwords. 

 Create a complex password. A variety of characters should be part of the password. For example, a 

password made of all lower case letters is a relatively simple password, but a password made of upper 

and lower case letters, digits, and symbols such as punctuation marks is relatively complex. The 

more complex the password is, the more difficult it will be for others to guess. Users should select 

passwords containing digits and/or symbols in addition to letters. Users should not create new 

passwords that are very similar to old passwords. For example, if the old password was “dahlia*1”, 

the new password should not be “dahlia*2”. 

 Do not use password hints. Password hints can be very helpful to people in guessing others’ 

passwords and using them to gain unauthorized access to a PC. Users should not use password hints 

unless their PCs do not need protection from people with physical access to them. 

 Do not use the same password for other accounts. Teleworkers should not use the same password 

for multiple accounts, such as professional and personal email accounts, instant messaging accounts, 

and e-commerce Web site accounts. If the password used for the telework PC is also used for other 

5-2
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

user accounts and an attacker learned one of the passwords, the attacker could then access the other 

accounts. 

Teleworkers should change their passwords regularly, based on the interval specified in their 

organizations’ password policies. This is necessary because if a password is unknowingly revealed to an 

unauthorized person or uncovered by malware or other automated attacks, the password could be used 

without authorization for a long time. 

If an OS password is forgotten, especially for an administrative account, it may be difficult to regain 

access to the PC. Therefore, users should consider writing down their OS passwords and storing them in 

a physically secure location, such as a locked fire safe. Users should also safeguard their other 

passwords, such as application and Web site passwords. For example, some organizations provide 

cryptographic tokens to teleworkers that can be used to hold passwords. When the teleworker needs to 

retrieve a password, he or she authenticates to the token (such as entering a PIN into the token), and the 

token provides the password. The token helps prevent users from losing their passwords while also 

protecting the passwords from attackers. Another option for protecting application and Web site 

passwords is a password management utility, which is a program that can be used to generate, store, and 

access passwords securely. A teleworker typically enters a single password to gain access to all the 

passwords stored by the utility. 

5.2.3 

5.3.1 

 

Protect User Sessions From Unauthorized Physical Access 

It is important that user sessions be protected against unauthorized physical access. For example, if a PC 

is sitting unattended in an area that other people can access, anyone could walk up to the PC and 

masquerade as the user, such as sending email from the user’s account, accessing the organization’s 

remote access resources, making purchases from Web sites, or accessing sensitive information stored on 

the PC. To prevent such events, most OSs allow the user to lock the current session through menu 

options or a combination of keystrokes. Also, many OSs offer screensavers that activate automatically 

after the PC has been idle for a certain number of minutes, and can also be activated manually by the user 

on demand. Some of these screensavers can be configured to lock the PC and require the user to enter his 

or her password to unlock it. If a PC will be left unattended in an accessible area at any time, users 

should use a password-protected screensaver or manually lock their user sessions. 

5.3 Networking Configuration 

Most PCs can be configured to limit network access, which reduces the number of ways in which 

attackers can try to gain access to the PC. This section makes recommendations for configuring 

networking features to better protect the PC. 

Disable Unneeded Networking Features 

By default, most PCs provide several networking features that can provide communications and data 

sharing between PCs. Most teleworkers need to use only a few of these features. Because many attacks 

are network based, PCs should use only the necessary networking features. For example, file and printer 

sharing services, which allow other computers to access a telework PC’s files and printers, should be 

disabled unless the PC shares its files or printers with other computers, or if a particular application on the 

PC requires the service to be enabled.12 Other examples of services that might not be needed are wireless 

networking protocols (e.g., Bluetooth, IEEE 802.11a/b/g/n) and infrared ports. (Consult the PC’s 

hardware and OS documentation for guidance on which network features should be disabled.) 

12 It is particularly important to disable such services if the PC will be used on unsecured wireless networks, such as most 

wireless hotspots. 

5-3
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

5.3.2 

5.3.3 

5.4.1 

Limit the Use of Remote Access Utilities 

Some OSs offer features that allow a teleworker to get remote technical support assistance from a 

coworker, friend, product vendor, or others when running into problems with a PC. Many applications 

are also available that permit remote access to the PC from other computers. Although these features are 

convenient, they also increase the risk that the PC will be accessed by attackers. Therefore, such utilities 

should be kept disabled at all times except specifically when needed. The utilities should also be 

configured to require the remote person to be authenticated, usually with a username and password, 

before gaining access to the PC. (See the recommendations in Section 5.2.2 for choosing strong 

passwords.) Provide the username and password to the remote person in person, by phone, or by other 

means that cannot be monitored by attackers; do not send passwords through email messages, instant 

messaging, or other methods that do not provide protection for communications. 

Configure Wireless Networking 

An improperly configured wireless network could transmit sensitive information without protecting it 

properly, allowing people nearby to eavesdrop. Section 4.2 explains how to secure a wireless home 

network. In addition, PCs should be configured so that they do not automatically attempt to join wireless 

networks they detect. For example, a PC could join a neighbor’s wireless home network instead of the 

teleworker’s network; if that neighbor’s network is improperly secured, then the teleworker’s 

communications and computer could be at higher risk. Therefore, teleworkers should configure their PCs 

so they do not join detected wireless networks automatically. Teleworkers should also configure their 

PCs so that they cannot use ad hoc networking, which is a relatively easy way to attack a PC. 

5.4 Attack Prevention 

As explained in Section 2, no 100-percent solution exists for computer security; it is simply not possible 

to thwart every single attack. PCs should use a combination of software and software features that will 

stop most attacks, particularly malware. The types of software described in this section are antivirus and 

antispyware software, personal firewalls, spam and Web content filtering, and popup blocking. Changing 

a few settings on common applications such as email clients and Web browsers can also stop some 

attacks. 

Although security tools can stop many attacks, teleworkers also need to practice safe computing habits. 

One of the most common ways that PCs are attacked is by users opening and executing files from 

unknown and untrusted sources. Teleworkers may download these files from Web sites, file sharing 

services, peer-to-peer programs, or other means, or they may be sent to teleworkers through email, instant 

messaging, and other communications services. These files often contain malware, and teleworkers 

unknowingly infect their PCs by trying to use these files. Teleworkers should avoid using any files that 

are coming from unknown and untrusted sources. 

Install and Configure Antivirus and Antispyware Software 

The most effective tool for protecting PCs against malware is antivirus software, which is specifically 

designed to detect many forms of malware and prevent them from infecting PCs, as well as cleaning PCs 

that have already been infected. Because malware is the most common threat against PCs, NIST 

recommends that every PC use antivirus software at all times. The antivirus software should be kept upto-date, as described in Section 5.1. 

Many brands of antivirus software are available, most of which offer similar functionality. NIST 

recommends configuring antivirus software to use the following types of functions: 

5-4
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

 Automatically checking for and acquiring updates of signature or data definition files at least daily 

 Scanning critical OS components such as startup files, system basic input/output system (BIOS), and 

boot records 

 Monitoring the behavior of common applications, such as email clients, Web browsers, file transfer 

and file sharing programs, and instant messaging software 

 Performing real-time scans of each file as it is downloaded, opened, or executed 

 Scanning all hard drives regularly to identify any file system infections, and optionally scanning 

removable media as well 

 Handling files that are infected by attempting to disinfect them, which refers to removing malware 

from within a file, and quarantining them, which means that files containing malware are stored in 

isolation for future disinfection or examination 

 Logging all significant events, such as the results of scans, the startup and shutdown of antivirus 

software, the installation of updates, and the discovery and handling of any instances of malware. 

Most antivirus products can identify several types of malware, including viruses, worms, Trojan horses, 

and malicious mobile code.13 Antivirus products offer varying levels of support for detecting spyware.14 

Separate antispyware utilities should be used to supplement any antivirus products that do not have robust 

spyware handling capabilities. Unlike antivirus software, which attempts to identify many types of 

malware, antispyware utilities specialize in malware and non-malware forms of spyware. Although some 

antispyware utilities specialize in a particular form of spyware, such as browser plug-ins, most can detect 

many types of spyware and offer similar features to antivirus software. The updating and configuration 

recommendations made earlier in this section for antivirus software also apply to antispyware utilities. 

5.4.2 

 

Use Personal Firewalls 

A personal firewall is a software program that monitors communications between a PC and other 

computers and blocks communications that are unwanted. When properly configured, a personal firewall 

limits the access that other computers have to the telework PC. This can significantly reduce the exposure 

of the PC to network-based attacks such as worms. A personal firewall can also be used to protect shared 

resources on a PC, such as file and print shares. Accordingly, a personal firewall should be installed and 

enabled on every telework PC. Personal firewalls should be configured to log significant events, such as 

blocked and allowed activity, the startup and shutdown of the firewall software, and firewall 

configuration changes, to assist in troubleshooting problems. All personal firewalls can monitor 

incoming communications, and some can also monitor outbound communications; the latter offers better 

security, but it can also inadvertently cause problems in using certain applications. 

Although personal firewalls are important security controls for PCs, they can be relatively difficult to 

configure correctly. If a personal firewall is configured to be too restrictive, it could prevent some 

13 A virus is a program that self-replicates—makes copies of itself—by infecting files and distributing copies of itself to other 

files, programs, or computers. A worm is a self-replicating program that is completely self-contained and self-propagating. 

A Trojan horse is a program that appears to be benign but actually has a hidden malicious purpose. Malicious mobile code

is software that is transmitted from a remote computer to be run on the local computer for malicious purposes, typically 

without the user’s explicit instruction or knowledge. 14 There are many commercial and free programs that can detect many types of malware. There are also free programs that are 

more specialized. For example, antivirus software vendors sometimes release free utilities that find and remove a particular 

worm that has spread throughout the Internet. Some operating system vendors also release free utilities, such as Microsoft’s 

malicious software removal tool that can find and remove certain instances of malware that frequently attack Windows 

operating systems (http://www.microsoft.com/security/malwareremove/default.mspx). 

5-5
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

applications or OS functions from working correctly. For example, a personal firewall might prevent the 

use of file and print services. On the other hand, if a personal firewall is configured to be too permissive, 

it could permit attacks to compromise the PC. Teleworkers should read their personal firewall 

documentation carefully to gain a solid understanding of how it should be configured. If it is not clear, 

teleworkers should seek expert guidance on configuring their personal firewalls.15

Ideally, personal firewalls should deny all types of communications that teleworkers have not specifically 

approved as being permitted. This is known as a deny by default configuration because all 

communications that are not on the exception list are denied (blocked) automatically. Most firewalls can 

be configured to allow communications based on lists of authorized applications, such as Web browsers 

contacting Web servers and email clients sending and receiving email messages. Communications 

involving any other application are either denied automatically, or permitted or denied based on the 

teleworker responding to a prompt asking for a decision regarding the activity. For example, if a 

teleworker installs a new application and runs it for the first time, the firewall might ask the teleworker if 

that application should be allowed to access the Internet. 

Unfortunately, this feature can be problematic. Personal firewalls often do not provide clear information 

on which application is attempting to use the network, so teleworkers struggle to determine if the activity 

is benign or malicious. If the nature of the activity is unclear, cautious teleworkers often choose to block 

the activity, but this may inadvertently disrupt legitimate activity. To avoid this problem, many 

teleworkers choose to permit access whenever asked, but this could support malicious activity. When 

unsure what to do, teleworkers should search for additional information about the service or software in 

question or ask someone with more security expertise for assistance. 

Each PC should only have a single personal firewall enabled.16 If multiple firewalls are enabled, they 

may interfere with each other. For example, one firewall might allow activity that the other one has been 

configured to block. This could slow the performance of the PC, cause applications to stop functioning 

properly, and weaken the computer’s security. When enabling a firewall, teleworkers should verify that 

the firewall’s functionality is enabled for every network interface on the PC, including wired and wireless 

network cards, dial-up modems, and VPNs. 

Many personal firewalls offer additional security features. For example, some firewalls can stop all 

network access to and from the PC when it is idle, such as after 15 minutes of inactivity. When the 

teleworker returns to the computer, network access is restored. Although this helps to protect the PC, it 

can also prevent the PC from downloading updates and disrupt user services such as instant messaging. 

Another feature that some firewalls offer is the ability to require teleworkers to enter a password before 

accessing the firewall’s configuration settings. This protects the configuration from being inadvertently 

or purposely altered by a user. 

Teleworkers should be aware that most firewalls are frequently stopping unwanted activity. For example, 

attackers are constantly performing scans for targets, and malware such as worms is constantly trying to 

infect more PCs. Teleworkers should not be alarmed by notices from their firewall that indicate that 

incoming connections were blocked or that a specific attack was attempted. If a firewall indicates that the 

PC was just scanned for a particular worm, that does not in any way indicate that the PC has actually been 

infected with a worm. Attackers often scan thousands of hosts per minute, essentially at random. 

 

15 Configuring a personal firewall can be a complex task. Some firewalls have rules for specific protocols, services, or port 

numbers (e.g., File Transfer Protocol [FTP], Hypertext Transfer Protocol [HTTP], Simple Mail Transfer Protocol [SMTP]). 

For these firewalls, proper configuration may require some degree of networking and security experience. 16 Having multiple personal firewalls installed on a single PC is fine as long as only one is enabled at a time. For example, 

some OSs have built-in personal firewalls, but a user might install a third-party firewall onto the computer because the thirdparty firewall is part of a security software suite that includes antivirus software and other security applications. 

5-6
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

5.4.3 Enable and Configure Content Filtering Software 

Content filtering is the process of monitoring communications such as email and Web pages, analyzing 

them for suspicious content, and preventing the delivery of suspicious content to users. Two common 

types of content filtering are spam filtering software and Web content filtering software. 

Spam—unsolicited email—is often used to deliver spyware and other forms of malware to users. Spam is 

also frequently used for performing phishing attacks, which are deceptive computer-based means to trick 

individuals into disclosing sensitive personal information. Spam filtering software analyzes emails to 

search for spam characteristics, and typically places messages that appear to be spam in a separate email 

folder. Most organizations perform spam filtering for their users; however, because spam filtering is 

subjective, some spam will still reach users, and some desired email messages will accidentally be 

classified as spam. Still, spam filtering software can significantly reduce the amount of spam that reaches 

users. Many email clients also offer some helpful spam filtering capabilities. 

Users can refine spam-filtering capabilities through the following customization options: 

 Blacklists. A blacklist is a list of email senders who have previously sent spam to a user. When a 

user receives a spam message, he or she can request that the sender’s email address be added to a 

blacklist. This will cause future emails from the same sender to be classified as spam automatically. 

 Whitelists. A whitelist is a list of email senders that are known to be benign, such as coworkers, 

friends, and family. A user can add their email addresses to a whitelist, which will cause their future 

emails to not be classified as spam. Spam filtering accidentally classifies some emails as spam that 

are not, but a whitelist overrides that classification and ensures that emails from trusted senders are 

received by the user. 

 Bayesian Spam Filters. A Bayesian spam filter determines the likelihood that a particular email 

message is spam, based on a comparison of the email’s characteristics with those of previously 

received spam messages. When a user receives email, the user corrects any errors that the spam 

filtering software has made. The Bayesian filter then analyzes the benign messages and the spam to 

record their characteristics. For example, a Bayesian filter might record that a user has received 

35 spam messages containing the phrase “FREE FREE FREE” but no benign messages with that 

phrase. When a user receives a new email, the filter looks for that phrase, as well as any other 

characteristics associated with benign or spam messages, and assigns a spam probability to the 

message. The effectiveness of Bayesian filters depends on users reviewing all their emails and 

ensuring each is marked correctly as being spam or not. 

Web content filtering software typically works by comparing a Web site address that a user attempts to 

access with a list of known bad Web sites. Although the primary purpose of Web content filtering 

software is to prevent access to inappropriate materials, many also contain lists of Web sites that are 

known as hostile, such as those attempting to distribute malware to visitors or hosting phishing Web sites. 

Web content filtering software might inadvertently classify benign content as inappropriate or vice versa. 

From a telework PC security perspective, spam content filtering technologies are strongly recommended 

for all email use; Web content filtering technologies also can be helpful but are considered optional. All 

content filtering products that are used should be kept up-to-date to ensure that their detection is as 

accurate as possible. 

5-7
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

5.5 Major Application Configuration 

Many attacks, particularly malware, take advantage of features provided by common applications such as 

email clients, Web browsers, instant messaging clients, and office productivity suites. By default, 

applications often are configured to favor functionality over security. Accordingly, teleworkers should 

consider disabling unneeded features and capabilities from applications, particularly those that are 

commonly exploited by malware. Teleworkers should also consider configuring applications to filter 

content and stop other activity that is likely to be malicious. Examples of application settings to consider 

are listed below. Teleworkers should be aware that a single PC might have multiple Web browsers, email 

clients, instant messaging clients, and office productivity suites installed, each of which may have 

different features and configuration settings.17

Teleworkers should also consider their organization’s policies regarding application use. For example, 

many organizations forbid the use of peer-to-peer software, file sharing programs, and VoIP software on 

organization-owned computers because of the increased security risks associated with the software. 

Teleworkers should remove policy-forbidden software from their telework computers to better protect the 

organization’s information. In general, teleworkers should install and use only known and trusted 

software on their telework PCs. 

5.5.1 

 

Web Browsers 

Teleworkers should consider adopting the following recommendations for the Web browsers on their 

telework PCs: 

 Use a separate Web browser for telework. Multiple Web browsers can be installed on a single PC. 

Accessing Web sites containing malicious content is one of the most common ways for PCs to be 

attacked, such as spyware plug-ins being installed in a browser. To reduce the likelihood that such 

attacks could impact telework, teleworkers can use one browser for telework only and another 

browser for all other Web site access. This separates the telework-related data from the other data. 

Having a separate browser for telework also allows the teleworker to secure it more tightly, such as 

disabling all forms of mobile code (e.g., Java, ActiveX) that are not required for telework (see Section 

5.5.2 for more information on mobile code). 

 Restrict Web browser cookies. A cookie is a small file that stores information for a Web site. 

Many Web sites place cookies on users’ computers. A persistent cookie stays on a computer to allow 

a Web site to identify the Web site’s user. Unfortunately, if someone else uses the same user account 

on the computer, some Web sites that use cookies may think that the two people are really the same 

person. The Web sites might then allow the second person to gain access to the first person’s 

information on the Web sites. Persistent cookies may also store sensitive information such as 

passwords or account numbers that could be accessed by other people using the same computer. 

Another type of cookie, a session cookie, is valid only for a single Web site session. Session cookies 

do not usually contain personal information. Most Web browsers can be configured to permit all 

session cookies and to permit persistent cookies to be set only for the same Web site that the user 

visited (first-party cookies), not for the Web sites of advertisers and others (third-party cookies). This 

balances the preservation of users’ privacy with the functionality that cookies can provide for Web 

site usage. 

17 Many vendors document their security recommendations in their product documentation or on their Web sites. Some 

vendors also make security checklists available for securing their operating systems, applications, and devices. Many of 

these checklists are posted on the NIST Security Checklists for IT Products site, located at http://csrc.nist.gov/checklists/. 

5-8
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

 Block popup windows. Nearly all Web browsers support the use of popup windows, which are 

standalone Web browser panes that open automatically when a Web page is loaded or a user performs 

an action designed to trigger a popup window. Many popup windows contain advertising, but they 

are increasingly being used as a way to attack computers. Some popup windows are crafted to 

resemble legitimate system message boxes or Web sites and can trick users into going to phony Web 

sites, including sites used for phishing, or authorizing changes to their computers, among other 

malicious actions. For example, a popup window may tell a user that the computer is infected with 

spyware and to click on OK to disinfect it. By clicking on OK, the user unwittingly permits spyware 

or other types of malware to be installed on the computer. To control popup windows, teleworkers 

should either configure their Web browsers to block them or use third-party popup blocking utilities 

that can block them. Both options prevent popup windows from opening and indicate to the 

teleworker that a popup window was blocked. If the teleworker did not want the window to be 

blocked, he or she could then choose to permit that particular popup window or all popup windows 

from a trusted Web site. 

 Enable phishing filter capabilities. Some browsers can detect possible phishing attempts and warn 

the user before allowing the user to visit a suspected phishing site. Teleworkers should check their 

browser’s documentation to see if it offers a phishing filter, and if so, enable it. 

 Remove unneeded browser plug-ins. A plug-in is a utility that works in conjunction with a Web 

browser to enhance the browser’s capabilities. Most plug-ins are beneficial, but some plug-ins are 

malicious. Teleworkers should periodically review the plug-ins installed in their browsers and 

uninstall all plug-ins that are unneeded or unknown to the teleworkers. If a necessary plug-in is 

accidentally uninstalled, the teleworker is usually prompted to download and install it the next time 

the teleworker accesses content that requires the plug-in. 

 Protect sensitive information stored by the browser. Browsers may store sensitive information on 

behalf of users, such as cached Web site passwords, digital certificates, and encryption keys. Some 

browsers have options for strongly protecting this information. Typically, the browser requires a user 

to enter a master password, which is used solely to protect the sensitive information. Teleworkers 

should check their browser’s documentation to determine if it offers a protection option, and if so, 

enable it and set a master password. 

 Prevent Web site passwords from being recalled automatically. Most browsers can save 

passwords that have been entered into Web sites. However, many browsers also offer auto-fill or 

auto-complete options that recall stored passwords and enter them into password text boxes 

automatically. This could allow someone else who accesses a telework device to gain access to 

various Web sites posing as the teleworker. To prevent this, teleworkers should configure their Web 

browsers so that they do not use auto-fill or auto-complete functions for usernames and passwords. 

 Run Web browsers with the least privileges possible. Some Web browsers, such as Microsoft 

Internet Explorer 7 running on Windows Vista, can run in a mode that offers low privileges, which 

means that actions performed within the Web browser can affect the computer in very limited ways. 

This helps prevent some attacks sent through Web browsers from succeeding and limits the damage 

caused by attacks that do succeed. Teleworkers should run their Web browsers with the least 

privileges possible. 

5.5.2 Email Clients 

Teleworkers should consider adopting the following recommendations for each email client on their 

telework PCs: 

5-9
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

 Prevent automatic loading of remote email images. Most email clients can be configured not to 

automatically load remote graphics pointed to by emails. This is particularly helpful for thwarting a 

form of spyware known as a Web bug. With this configuration setting, the outline of an unloaded 

Web bug appears as a small box within the email, and the teleworker’s activity cannot be tracked 

unless the teleworker chooses to have the image loaded. 

 Limit mobile code execution. Mobile code is a way for a remote computer, such as a Web site, to 

run programs on a teleworker’s device. Email messages can carry malicious mobile code that 

attempts to infect the device from which the messages are read. To prevent infections, most email 

clients can be configured to permit only the required forms of mobile code (e.g., JavaScript, ActiveX, 

Java). Teleworkers should consider disabling mobile code support in their email clients, with the 

understanding that the full content of certain benign email messages might not be available. 

 Set default message reading format and sending format to plain text. Most email clients allow 

users to specify the default format for reading and sending emails. The most commonly used formats 

are plain text and Hypertext Markup Language (HTML). Because malware, phishing, and other types 

of attacks often take advantage of features offered by HTML, it is preferable that the default message 

format be set to plain text. This will result in emails being displayed as text only, which means that 

pictures, hyperlinks, and other content provided through HTML would be omitted or displayed only 

through alternative text. Also, sending emails as plain text is helpful to other security-conscious users 

who prefer to read email messages in plain text. Another advantage of plain text emails is that they 

can be displayed properly on all types of devices, including cell phones and PDAs. 

 Disable automatic previewing and opening of email messages. Some email-based malware may 

be activated and infect a computer when the malicious email is previewed or opened. Many email 

clients can be configured to preview or open email messages automatically. This can provide an easy 

way for malware to infect a computer. Accordingly, email clients should be configured not to 

preview or open email messages automatically. This gives teleworkers an opportunity to identify and 

delete an email that appears to be suspicious based on the sender, recipient, subject, and other 

identifying information that can be reviewed without viewing the entire email. 

 Enable spam filtering. Section 5.4.3 has additional information concerning this issue. 

5.5.3 

5.5.4 

Instant Messaging Clients 

Teleworkers should consider adopting the following recommendations for each instant messaging client 

on their telework PCs: 

 Suppress the display of email addresses. If the teleworker’s displayed name or supporting 

information includes an email address, this may be harvested by malware or malicious users, then 

used in future attacks. 

 Restrict file transfers. If the software can transfer files with other instant messaging users, it should 

be configured to prompt the teleworker before permitting a file transfer to begin. File transfers are a 

common way to transfer malware to other computers and infect them. 

Office Productivity Suites 

Teleworkers should consider adopting the following recommendations for each office productivity suite 

on their telework PCs: 

 Restrict macro use. Applications such as word processors and spreadsheets often contain macro 

languages that certain types of viruses use. Most common applications with macro capabilities offer 

5-10
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

security features that permit macros only from trusted locations or prompt the user to approve or 

reject each attempt to run a macro. The prompting feature can be effective at stopping macro-based 

malware threats. 

 Limit personal information. Many office productivity tools allow personal information, such as 

name, initials, mailing address, and phone number, to be stored with each document created. 

Although the most basic information (typically, name and initials) are often needed for collaboration 

features and edit tracking, information such as mailing addresses and phone numbers is not. Personal 

information becomes embedded within document files and may inadvertently be distributed with files 

to others. Teleworkers should not enter any more personal information than necessary into the user 

settings of office productivity tools. For some word processors, teleworkers can use sanitization 

utilities that remove personal information from documents, as well as comments, tracked changes, 

and other information that might be embedded in documents but should not be part of the final 

document. 

 Use secured folders for application files. Most office productivity applications allow users to 

define default locations for saving documents and holding temporary files, including auto-save and 

backup copies of documents. This can be very helpful at protecting application files from 

unauthorized access by others. Teleworkers should also store their custom dictionary entries in a 

user-specific file stored in one of their protected folders. 

5.6 Remote Access Software Configuration 

As described in Section 2, teleworkers may have to install remote access software onto their telework PCs 

or configure software built into the PC’s OS. This software should be configured based on the 

organization’s requirements and recommendations. In many cases, the remote access software will be 

preconfigured by the organization so that teleworkers do not have to be concerned about configuring it. 

In general, remote access software should be configured so that only the necessary functions are enabled. 

Teleworkers should ensure that whenever updates to the remote access software are available, that they 

are acquired and installed. If the organization provides the updates, teleworkers should make sure that 

they will be notified when updates are available. 

5.7 Security Maintenance and Monitoring 

Teleworkers need to maintain their telework PCs’ security on an ongoing basis. Common responsibilities 

are as follows: 

 Confirming periodically that the OS and major applications are up-to-date. Many software programs 

have a menu option or other mechanism that displays the update status, such as the number of updates 

that have not yet been applied or the most recent date the software was updated. 

 Checking the status of security software periodically to ensure that it is still enabled, configured 

properly, and up-to-date. Some operating systems offer security dashboards that show the current 

status of the security software. Checking the software’s status should also include verifying that the 

regular scans performed by antivirus software and antispyware software have not found any 

infections on the PC. If an infection is still present, the teleworker should follow the security 

software’s instructions for disinfecting the PC. 

 Creating a new user account whenever another person needs to start using the PC, as well as disabling 

or deleting a user account whenever the associated person no longer needs to use the PC. All the user 

accounts should be reviewed periodically to ensure that only the necessary accounts are enabled. 

5-11
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

 Changing the teleworker’s PC password regularly in accordance with the organization’s password 

policy. 

 Periodically identifying security issues on the PC. Some OSs offer utilities that can be run to check 

the PC for potential problems. These utilities can identify missing software updates and incorrect 

security settings and can provide recommendations for fixing problems. However, understanding the 

reports that these utilities produce and properly implementing recommended solutions can require 

someone with considerable security expertise. Teleworkers without sufficient expertise should seek 

expert assistance before implementing any unclear recommendations. 

Teleworkers also need to investigate any cases in which the PC begins to display unusual behavior. 

Generally, the best first step is to reboot the computer; this clears many errors. If the problem persists, the 

next step should be to ensure that the computer’s software (especially antivirus and antispyware software) 

is fully up-to-date; then, the entire computer should be scanned using the antivirus and antispyware 

software. If any malware is detected, it should be removed using the antivirus and antispyware software; 

if no malware is detected, then additional troubleshooting steps need to be performed. Examples are as 

follows: 

 Checking antivirus and antispyware vendor Web sites for instances of malware that cause the unusual 

behavior being seen 

 Uninstalling and reinstalling an application that is not functioning properly 

 Searching the OS vendor’s Web site for information on similar problems 

 Using troubleshooting utilities that can provide insights into what is happening on the PC. 

If the problem still cannot be resolved, or the teleworker does not have sufficient knowledge to perform 

these troubleshooting steps, the teleworker should seek expert assistance, such as contacting the 

organization’s help desk if the organization provides support for personally owned telework computers. 

Teleworkers can assist with troubleshooting by collecting and documenting information regarding the 

problems. Some OSs provide features that automate this process, and some PC vendors install utilities on 

their PCs designed specifically for this purpose. Teleworkers should consult the PC’s hardware and OS 

manuals for information regarding such features. Teleworkers also should preserve error messages by 

performing a screen capture, copying and pasting the error message into a file or email, or writing down 

the error message verbatim on paper. (The appropriate technique should be selected based on the 

complexity of the error message and the PC’s support for performing screen captures, if any.) 

5.8 For More Information 

Because of various OSs and applications used by teleworkers, it is outside the scope of this publication to 

provide step-by-step directions for the security recommendations discussed in this section. Teleworkers 

should consult the security documentation provided on their OS and application vendors’ Web sites. 

NIST has additional information for a few common platforms. Table 5-1 maps the content of this section 

to more detailed content within NIST publications on Windows XP Home Edition and Windows XP 

Professional.18

 

18 NIST SP 800-69, Guidance for Securing Microsoft Windows XP Home Edition, is available at 

http://csrc.nist.gov/itsec/guidance_WinXP_Home.html. NIST SP 800-68, Guidance for Securing Microsoft Windows XP 

Systems for IT Professionals, is available at http://csrc.nist.gov/itsec/download_WinXP.html. The Windows XP Home 

Edition publication is written for users. The Windows XP Professional publication is written for IT professionals, but the 

portions of the publication with step-by-step directions should be easily understood by users. 

5-12
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Table 5-1. Mapping to Windows XP Guidance 

Section 5 Topic 

NIST SP 800-69 

(Windows XP Home Edition) 

Section 

NIST SP 800-68 

(Windows XP Professional) 

Section 

5.1, Software Updates 3.1.1 4.3 

5.2, User Accounts and Sessions 3.1.2 7.2 

5.3, Networking Configuration 3.1.3 7.5, 7.8 

5.4, Attack Prevention 3.3 7.6, 8.4, 8.5, 8.6 

5.5, Major Application Configuration 3.3.6 8.1, 8.2, 8.3 

5.7, Security Maintenance and Monitoring 8 2.6 

5-13
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

6. Securing Telework Consumer Devices 

Teleworkers who use their own consumer devices for telework, particularly cell phones, PDAs, and smart 

phones (hybrid cell phone/PDA devices, such as the BlackBerry and Windows Mobile), should 

implement the recommendations presented in this section. Teleworkers who do not need to secure 

consumer devices can skip this section. 

A wide variety of consumer devices exist, and the security features available for these devices also vary 

widely. Some devices offer only a few basic features, whereas others offer sophisticated features similar 

to those offered by PCs. This does not necessarily imply that more security features are better; in fact, 

many devices offer more security features because the capabilities they provide, such as wireless 

networking and instant messaging, make them more susceptible to attack than devices without these 

capabilities. In general, consumer devices currently face fewer threats than PCs, but threats against 

consumer devices are increasing. The variety in security features makes it infeasible to create specific 

recommendations that apply to all consumer devices; therefore, teleworkers should consult the 

documentation provided by their device manufacturers and service providers (e.g., cellular service) and 

follow their security recommendations. General recommendations are as follows: 

 Limit access to the device. Most consumer devices allow the owner to restrict access by setting a 

PIN or password; some also support more sophisticated authentication mechanisms, such as 

biometrics (e.g., the owner’s thumbprint). Using some sort of authenticator prevents or deters access 

to the teleworker’s information and service by a person who gains unauthorized physical access to the 

device. Some devices can also be configured to lock themselves automatically after an idle period; a 

person attempting to use the device when it is locked must authenticate again to unlock it. PINs and 

passwords should be changed periodically and whenever teleworkers suspect that someone else may 

know them. 

 Disable networking capabilities except when they are needed. Many consumer devices offer 

multiple types of networking capabilities, such as IEEE 802.11a/b/g/n, Bluetooth, and infrared.19 

Attackers can try to use these capabilities to access information on the device or use the device’s 

services. This can be prevented by disabling each networking capability that is not used, and by 

enabling necessary capabilities only when they are going to be used. For example, if a person only 

uses a Bluetooth earpiece occasionally with a cell phone, then the teleworker could enable the cell 

phone’s Bluetooth capability only when the teleworker wants to use the earpiece and disable it when 

the teleworker is done with the earpiece. 

 Use additional security software, if appropriate. Antivirus software and personal firewall software 

are available for some consumer devices, particularly those with traditional PDA capabilities such as 

downloading email messages and synchronizing documents with PCs. If feasible, antivirus software 

should be installed and enabled on consumer devices and configured to monitor activity on each 

network interface. Personal firewall software should be installed and enabled on consumer devices 

that use Transmission Control Protocol/Internet Protocol (TCP/IP) networking and configured to 

restrict activity on each TCP/IP interface. Both antivirus software and personal firewall software 

should be kept up-to-date. Section 5.4 contains additional information on antivirus software and 

personal firewalls.20

 

19 In addition, some devices can accept third-party networking cards to provide additional networking capabilities. Consult the

cards’ documentation as well and remove or disable the cards if they are not needed. 20 Some types of devices are less susceptible to particular categories of attacks than others. For some types of devices, 

malware and other automated attacks are not a significant threat, and antivirus software or personal firewalls may not even 

be available. 

6-1
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

 Keep devices updated. Some consumer devices can be updated or patched to eliminate known 

security flaws. Devices that support updating may do so directly (e.g., the teleworker selects an 

option on the device to get an update) or indirectly (e.g., the teleworker downloads a patch onto a PC, 

and then installs the patch onto the consumer device through a data cable connecting the two). If a 

device does support updating, teleworkers should follow the provided instructions to ensure that 

security updates are identified, acquired, and installed regularly, at least monthly. Some updates 

cause all data on the device to be lost, so teleworkers should check for that and perform a full device 

backup before applying such an update. 

 Configure applications to support security. Many applications on consumer devices, such as Web 

browsers, are often configured by default to favor functionality over security. Accordingly, 

teleworkers should consider disabling unneeded application features and configuring applications to 

stop or block activity that is likely to be malicious. Section 5.5 provides configuration 

recommendations for Web browsers, email clients, and instant messaging clients on personal 

computers; these recommendations should also be applied to consumer devices to the extent possible. 

Teleworkers should be cautious about connecting consumer devices to other computers, such as 

synchronizing data between a PDA and a desktop computer. Malware could be transmitted from one 

device to another during a synchronization. Also, a synchronization could inadvertently cause sensitive 

information to be transferred from one device to another, and the second device might not be configured 

to provide adequate protection to that information, putting it at higher risk of exposure. Before 

connecting a consumer device to another computer, teleworkers should ensure that the consumer device 

and the computer to which it will be attached have both been properly secured. 

Teleworkers should also be cautious about downloading and installing software onto a consumer device if 

the software is not being provided by either the organization or the device’s vendor. An example is 

downloading games from an unfamiliar Web site. Such software could reduce the security of the device 

if the software is not configured properly, or the software itself could contain malware that would infect 

the device. The software could also inadvertently disrupt other applications, including security software. 

6-2
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

7. Assessing the Security of Third-Party Devices 

Teleworkers often want to perform remote access from devices owned by third parties, such as checking 

email from a kiosk computer at a conference. However, when a third party is responsible for securing a 

device, teleworkers typically do not know if it has been secured properly. Consequently, a teleworker 

could perform remote access from a device infected with malware intended to steal information from 

users, such as their passwords or email messages. 

Many organizations either forbid third-party devices to be used for remote access or permit only limited 

use, such as for Web-based email. If an organization permits the use of third-party devices for telework, 

teleworkers should assess the security state of such a device before using it. A teleworker’s ability to do 

this depends on several factors (e.g., teleworker’s familiarity with the device, the device’s OS and 

security applications, the device’s configuration, and the type of device). Generally, it is much more 

difficult to determine the security state of a consumer device than a PC. 

7.1 Security of PCs 

Questions that a teleworker should keep in mind when considering whether a PC is reasonably secure 

include the following: 

 Who is responsible for securing the PC? If the responsible party has considerable expertise in 

securing PCs, then the PC is more likely to be well-secured than if the party has limited security 

knowledge. If the responsible party is unknown, teleworkers should be cautious about using the PC. 

 Is the PC’s software fully updated? On many PCs, a teleworker can quickly check whether the PC 

is fully patched, and if not, how many patches are pending and how old those patches are. (The 

method for performing this is specific to the PC’s OS.) A PC that has not been patched for months is 

not well secured. 

 Is the antivirus software properly configured? The PC should have antivirus software installed, 

enabled, and configured to scan files as they are opened or downloaded. The antivirus software 

should be reasonably up-to-date, with the oldest pending update no more than a few weeks old, and 

preferably only a few days old at most. If possible, before using the PC, the teleworker should direct 

the software to update itself and then perform a scan of the PC to confirm that it is free of malware. 

 Is the personal firewall properly configured? Every PC should have a personal firewall installed, 

enabled, and configured to prevent unauthorized incoming activity. 

 Is the PC functioning properly? If the PC displays strange error messages, locks up or reboots 

itself, or exhibits other signs of a problem, teleworkers should be cautious because the problem could 

be caused by attacks against the PC. 

 How many people have used this PC? The more people that use a PC, the more likely it is that at 

least one of them has violated a recommended security practice or performed other actions that could 

have undermined the security of the PC. For example, a user could have visited a malicious Web site 

and inadvertently allowed spyware to be installed on the PC. PCs accessible by the public may have 

been used by hundreds or thousands of people. Whenever possible, teleworkers should not use 

publicly accessible PCs for telework, including remote access to email and other applications. 

 Does each person who uses the PC have a separate user account? If all users of a PC share a 

single account, it is more likely for that account to have security problems than an account on a PC 

7-1
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

where each user has a separate one. For example, malware may infect the files for a single account 

but not for other accounts. 

Satisfactory answers to all of these questions do not necessarily indicate that a particular PC is secure; 

however, unsatisfactory answers do indicate a higher potential of security problems. If in doubt about the 

security of a third party-secured PC, teleworkers should be cautious and avoid using it. Many teleworkers 

choose not to use any third party-secured PCs for remote access because of security concerns. 

7.2 Security of Consumer Devices 

As previously mentioned, it is generally quite difficult to assess the security of a third-party consumer 

device. The questions presented in Section 7.1 for assessing PC security generally do not apply to 

consumer devices because they usually have few security features. Teleworkers whose organizations 

permit the use of third-party consumer devices for telework should use them only to access nonsensitive 

information, such as general emails because on most consumer devices it is difficult to identify what 

information has been saved onto them. For the same reason, organization files such as documents and 

spreadsheets should not be downloaded onto third-party consumer devices or otherwise accessed from 

them. 

7-2
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Appendix A—Additional Security Considerations for Telework 

In addition to securing telework devices and home networks, there are additional security-related 

considerations for telework. For example, teleworkers should consider the relative security of phone 

services such as cordless phones, cellular phones, and Voice over Internet Protocol (VoIP) services. 

Other possible security concerns include the use of wireless personal area network (WPAN) technologies, 

such as Bluetooth and infrared; use of wireless broadband network technologies; and secure destruction of 

removable media, printed materials, and other forms of media that may contain sensitive information. 

This appendix provides recommendations for each topic. 

A.1 

A.2 

Phone Services 

Depending on the sensitivity of telework communications, telephone security may be a consideration. 

The various choices for telephones and telephone services spans a wide spectrum of privacy capabilities. 

At the low end are older cordless phones, whose calls may be picked up by walkie-talkies, baby monitors, 

and radio scanners; at the high end are corded phones. The most commonly used options are summarized 

below. 

 Corded phones using traditional wired telephone networks. Physical connections are required to 

intercept communications involving traditional corded telephones that use wired telephone networks, 

so they are sufficiently secure for typical telework. Security for corded phones used with VoIP 

networks is described below. 

 Cordless phones using traditional wired telephone networks. Cordless phone communications 

can be intercepted by eavesdroppers within physical proximity of the phone, often a few hundred 

yards at most. Cordless phones used for telework should employ spread spectrum technology, which 

uses a rapidly changing set of frequencies to scramble transmissions, thus reducing the risk of 

eavesdropping. Security for cordless phones used with VoIP networks is described below. 

 Cellular phones. Most cell phones use digital technology, and their transmissions are scrambled to 

deter eavesdropping. Digital cell phones should be acceptable for typical telework. Older cellular 

phones use analog technology. Analog calls can be intercepted by individuals with scanning 

equipment, so teleworkers should avoid using analog cell phones for discussions involving sensitive 

or proprietary information. 

 Voice over IP. There are many services that offer local and long-distance phone service over the 

Internet. Known as VoIP, the services convert speech to Internet messages and transmit them to a 

facility that interfaces with the telephone network. The party on the other end can be using any type 

of phone service, not just VoIP. From a security standpoint, this type of connection is susceptible to 

eavesdropping because it is carried over the local network, the Internet service provider’s network, 

and sometimes the Internet. Because of the potential for vulnerabilities in one or more of these 

networks, communications carried over VoIP should not be considered secure unless some form of 

encryption is used. Accordingly, VoIP should not be used for telework discussions involving 

sensitive or proprietary information. 

WPAN Technologies 

WPANs are small-scale wireless networks that require no infrastructure to operate. A WPAN is typically 

used by a few devices in a single room to communicate without the need to physically connect devices 

with cables. Examples include using a wireless keyboard or mouse with a computer, printing wirelessly, 

synchronizing a personal digital assistant (PDA) with a computer, and allowing a wireless headset or 

earpiece to be used with a cell phone. The two most commonly used types of technologies for WPANs 

A-1
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

are Bluetooth and infrared. Although these two technologies have similar capabilities, they also have a 

few important differences. Infrared requires an unobstructed line of sight between the two devices using 

it, whereas Bluetooth does not. Furthermore, devices using infrared generally have to be within a meter 

(a few feet) of each other, whereas Bluetooth devices can be up to 100 meters (300 feet) apart, depending 

on output power. 

As Sections 5 and 6 mention, teleworkers should disable Bluetooth and infrared when they are not in use. 

In addition, Bluetooth users should use a personal identification number (PIN) that is at least eight 

characters long, preferably one that includes letters and digits. This makes it more difficult for an attacker 

to guess the PIN and gain access to the Bluetooth devices. For Bluetooth devices that do not support the 

use of long PINs (some permit only four-digit PINs), teleworkers should choose hard-to-guess PINs. 

Teleworkers should also configure their Bluetooth devices to encrypt their communications, if the devices 

support it; the devices’ documentation should provide the necessary information on configuring 

encryption capabilities. 

A.3 

A.4 

Wireless Broadband Data Network Technologies 

Cellular phone service providers offer wireless broadband data networks, a form of mobile networking for 

laptops and other types of computers. This technology allows a computer to have wireless access to the 

Internet from nearly any location. Because of the nature of cellular communications, it is much more 

difficult for an attacker to eavesdrop on wireless broadband networks than WLANs, but it is still possible. 

Therefore, teleworkers should assume that wireless broadband communications are not sufficiently secure 

for transmitting sensitive information. Teleworkers should consult with their organization to determine 

what protection the organization’s remote access solution provides before using wireless broadband to 

send or receive sensitive information. 

Information Destruction 

When a teleworker-owned computer is no longer going to be used, it should be prepared for retirement. 

The computer’s built-in storage devices, such as hard drives, often contain information that teleworkers 

might not want others to see, including their organizations’ files and their personal information, such as 

files from tax return software. Even if the teleworker deletes all of the files from the computer, curious 

people who get access to the computer might be able to recover the files using free or inexpensive 

software utilities specifically designed to recover deleted files. Accordingly, teleworkers should ensure 

that all data on their computers’ built-in storage devices is wiped out before donating, selling, or 

discarding a computer. Methods of performing these actions are as follows: 

 Use a third-party disk scrubbing utility. Several commercial software products are available that 

are specially designed to remove traces of data from computers. Follow the vendor directions for 

removing data from the hard drive. 

 Retain the hard drive. Following the instructions in the computer vendor’s documentation, a 

teleworker can remove the hard drive from the computer. If other people want to use the computer in 

the future, they can purchase a new hard drive and install an operating system (OS) onto the 

computer. This is the best option if the computer is no longer functioning properly, preventing the 

use of disk scrubbing utilities.

 Destroy the hard drive. Hard drives can be degaussed, which involves applying a magnetic field to 

the drive that makes it unusable. Hard drives can also be shredded or otherwise physically destroyed 

through specialized equipment and services.

A-2
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Teleworkers also need to ensure that removable media, printed materials, and other forms of media that 

may contain sensitive information are also destroyed. Many organizations provide information 

destruction services for their teleworkers, such as scrubbing or destroying hard drives and shredding 

removable media and printed materials. 

A-3
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Appendix B—Glossary 

Selected terms used in the publication are defined below. 

Administrative Account: A user account with full privileges, intended to be used only when performing 

personal computer (PC) management tasks such as installing updates and application software, managing 

user accounts, and modifying operating system (OS) and application settings. 

Blacklist: A list of email senders who have previously sent spam to a user. 

Consumer Device: A small, usually mobile computer that does not run a standard PC OS. Examples of 

consumer devices are networking-capable personal digital assistants (PDA), cell phones, and video game 

systems. 

Content Filtering: The process of monitoring communications such as email and Web pages, analyzing 

them for suspicious content, and preventing the delivery of suspicious content to users. 

Cookie: A small file that stores information for a Web site on a user’s computer. 

Daily Use Account: See “Standard user account.” 

Disinfect: To remove malware from within a file. 

Malicious Code: See “Malware.” 

Malware: A computer program that is covertly placed onto a computer with the intent to compromise 

the privacy, accuracy, or reliability of the computer’s data, applications, or OS. Common types of 

malware threats include viruses, worms, malicious mobile code, Trojan horses, rootkits, and spyware. 

Personal Computer: A desktop or laptop computer running a standard PC OS (e.g., Windows Vista, 

Windows XP, Linux/UNIX, and Mac OS X). 

Personal Firewall: A software program that monitors communications between a PC and other 

computers and blocks communications that are unwanted. 

Phishing: Deceptive computer-based means to trick individuals into disclosing sensitive personal 

information. 

Popup Window: A standalone Web browser pane that opens automatically when a Web page is loaded 

or a user performs an action designed to trigger a popup window. 

Quarantine: To store files containing malware in isolation for future disinfection or examination. 

Remote Access: The ability for an organization’s users to access its non-public computing resources 

from locations other than the organization’s facilities. 

Remote System Control: Remotely using a computer at an organization from a telework computer. 

Security Controls: See “Security Protections.” 

B-1
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Security Protections: Measures against threats that are intended to compensate for a computer’s security 

weaknesses. 

Service Set Identifier (SSID): A name assigned to a wireless AP. 

Social Engineering: A general term for attackers trying to trick people into revealing sensitive 

information or performing certain actions, such as downloading and executing files that appear to be 

benign but are actually malicious. 

Spam: Unsolicited email. 

Standard User Account: A user account with limited privileges that will be used for general tasks such 

as reading email and surfing the Web. 

Telecommuting: See “Telework.” 

Telework: The ability for an organization’s employees and contractors to conduct work from locations 

other than the organization’s facilities. 

Telework Device: A PC or consumer device used for performing telework. 

Virtual Private Network (VPN): A tunnel that connects the teleworker’s computer to the organization’s 

network. 

Vulnerability: A security weakness in a computer. 

Whitelist: A list of email senders known to be benign, such as a user’s coworkers, friends, and family. 

Wired Equivalent Privacy (WEP) Key: A series of characters (either a password composed of letters, 

digits, and punctuation, or a long hexadecimal number) that is used to limit access to a wireless network. 

B-2
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Appendix C—Acronyms 

Acronyms used in this guide are defined below. 

AES Advanced Encryption Security 

AP Access Point 

BIOS Basic Input/Output System 

DSL Digital Subscriber Line 

FISMA Federal Information Security Management Act 

FTP File Transfer Protocol 

HTML Hypertext Markup Language 

HTTP Hypertext Transfer Protocol 

IEEE Institute of Electrical and Electronics Engineers, Inc. 

IP Internet Protocol 

IPsec Internet Protocol Security 

ISP Internet Service Provider 

IT Information Technology 

ITL Information Technology Laboratory 

MAC Media Access Control 

NAT Network Address Translation 

NIST National Institute of Standards and Technology 

OMB Office of Management and Budget 

PC Personal Computer 

PDA Personal Digital Assistant 

PII Personally Identifiable Information 

PIN Personal Identification Number 

SMTP Simple Mail Transfer Protocol 

SSID Service Set Identifier 

SSL Secure Sockets Layer 

TKIP Temporal Key Integrity Protocol 

VoIP Voice over Internet Protocol 

VPN Virtual Private Network 

WEP Wired Equivalent Privacy 

WPA Wi-Fi Protected Access 

WPAN Wireless Personal Area Network 

C-1
USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS (DRAFT) 

Appendix D—Resources 

The lists below provide examples of resources that might be helpful in securing devices used for 

telework. 

Resource Sites 

Site Name URL 

Home Computer Security http://www.us-cert.gov/reading_room/HomeComputerSecurity/ 

Information for New and Home Users http://www.cert.org/homeusers/ 

Interagency Telework Site http://www.telework.gov/ 

Security at Home http://www.microsoft.com/athome/security/default.mspx 

Stay Safe Online http://www.staysafeonline.info/ 

Documents 

Document Title URL 

NIST SP 800-69, Guidance for Securing 

Microsoft Windows XP Home Edition 

http://csrc.nist.gov/itsec/guidance_WinXP_Home.html 

Safe at Any Speed http://www.staysafeonline.org/basics/resources/FTCsafeatanyspeed.pdf 

Seven Simple Computer Security Tips for 

Small Businesses and Home Computer 

Users 

http://www.infragard.net/library/seven_tips.htm

D-1