NIST SB 1997-01 Security Issues for Telecommuting.txt

NOTE:  To view this bulletin in html format, which includes a
diagram, visit our Web site at http://www.nist.gov/itl/lab/csl-
bull1.html.

SECURITY ISSUES FOR TELECOMMUTING
Information and telecommunications technologies make
telecommuting an option for many organizations and workers. 
Organizations promote telecommuting to allow their employees to
work from home, while on travel, at a client site, or in a
telecommuting center.  While offering potential benefits,
telecommuting introduces new risks to the organization.  This
bulletin highlights security issues related to telecommuting and
proposes solutions that may help organizations manage the
telecommuting environment more effectively.

Telecommuting is the use of telecommunications to create an
"office" away from the established (physical) office.  The
telecommuting office can be in an employee's home, a hotel room
or conference center, an employee's travel site, or a
telecommuting center.  The telecommuter's office may or may not
have the full computer functionality of the established office. 
For example, an employee on travel may read email.  On the other
side of the spectrum, an employee's home may be equipped with
Integrated Services Digital Network (ISDN) access to provide the
employee full computer capability at high speeds.

The Risk of Telecommuting
One of the popular buzz words for management in the '90s,
telecommuting is becoming accepted as the way to do business. 
However, opening up an organization's information systems to
dial-in and other forms of access presents significant security
risks.  

One risk is that intruders will be able to access corporate
systems without having to be on site.  Hackers, electronic
eavesdroppers at conference sites, or shoulder surfers watching
employees enter IDs and passwords, present very real threats.  In
addition to intruders whose goal may be mischief, hacking is
attractive to people trying to steal or misuse corporate
information.  Electronic access to records may be difficult to
trace and thus more appealing than trying to bribe employees or
gain physical access.  

Another risk of telecommuting is that corporate information can
be read, and potentially modified, while it is in transit. 
Telecommuting also presents organizations with more commonplace
risks.  These include the risk of losing corporate information
and resources when they are outside the protective shell of the
organization.

Security Issues for Protecting Internal Systems
In planning for secure telecommuting, management must first
determine what type of access is needed.  What systems and data
do employees need?  What is the sensitivity of these systems and
data?  Do they need system administrator privileges?  Do they
need to share files with other employees?  Is the data
confidential?

>From a security perspective, the critical determinations are:

    What would happen if an intruder gained the same access as
     the employee?

    What would happen if an intruder were able to use the
     employee's account, but gain more access than authorized for
     that user?

If these circumstances would result in the loss of organizational
resources, managers must take steps to ensure that the integrity
of their information systems is not compromised by telecommuting
employees of the organization.

Firewalls/Secure Gateways
A secure gateway, called a firewall, blocks or filters access
between two networks, often between a private network and a
larger, more public network such as the Internet or public
switched network (i.e., the telephone system).  For
telecommuting, organizations must decide what to make available
to telecommuting employees using public networks, what degree to
ensure that only authorized users can get to the internal
network, and how to ensure that the secure gateway works
properly.

If possible, managers should put all the resources needed by
telecommuting employees outside of a secure gateway.  However,
this is only feasible if employees do not need access to
corporate databases.  For example, employees may only need to
send reports in or access public databases, such as product/sales
information or government forms.

However, most telecommuting employees require more access.  For
traveling employees, this may be limited to access to email. 
There are many firewall implementations that use an email proxy
to allow access to the files on a protected system without having
to directly access that system.  However, some telecommuting
employees need access to internal resources.  The employees may
need to use a variety of resources such as local area network
(LAN) applications, mainframe applications, running client
software, or Transmission Control Protocol/Internet Protocol
(TCP/IP) services.  

A secure gateway, or series of gateways, can be used to divide
internal resources based on access need of telecommuters.  For
example, computers with high-risk organizational data (such as
proprietary business plans) may be separated by a gateway from
systems with a lower level of risk.  A series of gateways can be
used to further restrict access to the highest-risk systems.
For some situations, current firewall technology can be used to
give virtual access by using proxies.  In addition, current
firewalls can use IP filtering to limit access to certain types
of resources.  

For many organizations, the primary security function of the
secure gateway is to provide robust authentication of users.  
Secure gateways may also provide additional auditing and session
monitoring.  The gateway can perform an intrusion detection
function.  For example, the secure gateway could monitor a
session for keystrokes which may indicate someone trying to
exceed access (e.g., ^C, ^Z).  

Robust Authentication
For most organizations, robust authentication should be required
if access is given to internal systems.  However, organizations
should require robust authentication even for email if it is
relied upon to discuss business decisions (i.e., if the
organization would care if someone else read your email).

Robust authentication increases security in two significant ways. 
It can require the user to possess a token in addition to a
password or personal identification number (PIN).  Tokens when
used with PINs provide significantly more security than
passwords.  For a hacker or other would-be impersonator to
pretend to be someone else, the impersonator must have both a
valid token and the corresponding PIN.  This is much more
difficult than obtaining a valid password and user ID combination
(especially since most user IDs are common knowledge).  

Robust authentication can also create one-time passwords. 
Electronic monitoring (eavesdropping or sniffing) or observing a
user type in a password is not a threat with one-time passwords
because each time a user is authenticated to the computer, a
different "password" is used.  (A hacker could learn the one-time
password through electronic monitoring, but it would be of no
value.)

Most commercial robust authentication systems use smart tokens. 
The user provides a PIN which unlocks the token and then uses the
token to create a one-time password.  However, it is possible to
use software-only one-time password schemes.  (Tokens which do
not provide for one-time passwords, such as automated teller
machine (ATM) cards, are less common for telecommuting because
they require hardware at the remote site and, without physical
security, are vulnerable to electronic monitoring.)

Telecommuting employees who directly access internal systems
should be robustly authenticated and should be routed to specific
computer systems.  The combination of robust authentication and
routing increases security significantly and reduces costs
associated with robust authentication by limiting it to employees
with the greatest access.

It is possible, however, for an intruder to steal a session which
had been originally authenticated with conventional or robust
authentication.  For applications with very high security
concerns, authentication should be performed continuously through
the use of cryptography.  Other methods of performing continuous
authentication, such as applying a digital signature to every
packet, are being developed but are not currently widely
available in commercial products.

The following figure diagrams an example of an organization with
multiple access points for telecommuting that segregates
telecommuters into three risk-based areas.  Access to Host 1 is
granted based on simple password-based authentication.  Host 1
contains read-only applications.  There is no confidential data
on Host 1.  Access to Host 2 is granted based on robust
authentication, but is outside the firewall.  The rationale for
creating Host 2 is to be able to support applications that the
firewall cannot protect against (e.g., no proxy is available). 
Access to internal systems (Host 3, Host 4, and the LAN) requires
robust authentication.  The firewall uses proxies to mediate
between the external network (including both Internet and dial-in
connectivity) and the internal network.  

(See html version for diagram.)

Three caveats need to be made:

 Any additional logins (to Host 3 or Host 4, for example) are in
the clear.  Anyone eavesdropping on the connection can gain a
valid ID and password to Host 3 or Host 4.  With proper
configuration management (i.e., no modem connections inside the
firewall), these systems will not be directly accessible from the
outside and the ID and password will not be usable.

 Too much or too complicated segregation may prevent users from
sharing information necessary to perform their jobs.  

 Firewall and router administration requires careful and correct
implementation of rules (system-specific policy).

Port Protection Devices
A port protection device (PPD) is fitted to a communications port
of a host computer and authorizes access to the port itself,
prior to and independent of the computer's own access control
functions.  A PPD can be a separate device in the communications
stream (typically PPDs are found only in serial communications
streams) or it may be incorporated into a communications device
(e.g., a modem).  PPDs typically require a separate
authenticator, such as a password, in order to access the
communications port.

One of the most common PPDs is the dial-back modem.  In a typical
dial-back modem sequence, a user calls the dial-back modem and
enters a password.  The modem hangs up on the user and performs a
table lookup for the password provided.  If the password is
found, the modem places a return call to the user (at a
previously specified number) to initiate the session.  The return
call itself also helps to protect against the use of lost or
compromised accounts.  This is, however, not always the case. 
Malicious hackers can use such advanced functions as call
forwarding to reroute calls.

Security Issues for Data Transfer
In addition to gaining access to internal systems, intruders can
also eavesdrop on an entire session.  Eavesdropping is not
technically difficult if there is physical access to cable or
wire used for communication or logical access to switching
equipment.  

If a telecommuting employee is transferring data that an
eavesdropper would want, encryption may be necessary. 
Eavesdropping is more likely if an employee is at a large
conference or other location where an eavesdropper may set up
equipment in hopes of hearing something useful.  Some conferences
offer equipment to attendees to use to check email, transfer
files, etc.  Attendees find this useful, since they do not need
to provide laptops; however, this could be a target for
electronic eavesdropping.

Software- or hardware-based encryption provides strong protection
against electronic eavesdropping.  However, encryption is more
expensive (in initial and operating costs) than robust
authentication.  It is most useful if highly confidential data
needs to be transmitted or if moderately confidential data is
transmitted in a high-threat area.  Since employees do not always
know when they are in a high-threat area, management must train
employees to consider this potential threat.

Security Issues for Telecommuting from Home 
In addition to risks to internal corporate systems and data in
transit, telecommuting from home raises other concerns related to
whether employees are using their own computers or using
computers supplied to them by the organization.

Home Data Storage Integrity and Confidentiality
Other members of the employee's household may wish to use the
computer used for telecommuting.  Children, spouses, or other
household members may inadvertently corrupt files, introduce
viruses, or snoop.  Organizations can take several approaches:

    Employee accountability.  Some organizations may choose not
     to have specific rules forbidding household members from
     using personal computers (PCs), but hold the employee
     responsible for the integrity and confidentiality of the
     data.  Obviously, if the data is highly confidential, this
     is not a good choice.

    Removable hard drives.  If corporate data is stored on a
     removable hard drive (or floppy), the risk is greatly
     reduced.

    Data encryption.  Corporate data can be kept encrypted on
     the hard disk.  This protects its confidentiality and
     detects changes to files.

    Dedicated use.  If an organization requires dedicated use,
     management should recognize that it is difficult to enforce. 
     

Home System Availability 
In addition to the possibility of failure or theft of a home
computer, it may not be compatible with office configurations. 
For example, the home computer may use a different operating
system.  This and other circumstances may complicate set up,
software support, troubleshooting, or repair.  Organizations
should ensure that policies are in place to cover all of these
situations.

Security Issues for Telecommuting Centers
Telecommuting centers, normally located in outlying suburbs,
offer another choice for organizations.  From a security
perspective, they may provide hardware for encryption, removable
hard drives, and increased availability.  However, by
concentrating telecommuters, the centers may make themselves a
more attractive target for eavesdropping.  At a minimum,
organizations should require robust authentication from
telecommuting centers.  If communications encryption is supported
by the center, organizations should be aware that data may not be
encrypted while it is inside the center.  The encryption may
occur at a modem pool.

Conclusion
In summary, telecommuting offers potential benefits to employees
and organizations.  With adequate attention to security, it is
possible to create "an office away from the office."

References

Ascend Communications, Telecommuting Network Planning Guide: A
Resource Guide for Planners, Executives and Information Managers,
Alameda, CA.

Bill Boyle, Cable & Wireless Staff are to Work from Home,
Computer Weekly, April 27, 1995, p. 6(1).

IDC Government, Telecommuting: New Challenges in Information
Security, IDCG Pub. No.: W1831, March 1995.

NIST's Information Infrastructure Task Force Committee on
Applications and Technology, The Information Infrastructure:
Reaching Society's Goals, NIST Special Publication 868.

John Pescatore, Telecommuting and Security Aspects, Research
Activity #9008, IDC Government, February 9, 1996.

Johna Till Johnson and K. Tolly, The Safety Catch, Data
Communications Magazine, May 1995.

John P. Wack, and L. Carnahan, Keeping Your Site Comfortably
Secure: An Introduction to Internet Firewalls, NIST Special
Publication 800-10, December 1994.

http://www.telecommute.org/links.html#tc - includes resource
links to new stories, organizations, teleworking studies, and
telecommuting centers.

http://www.pacbell.com/Lib/TCGuide/tc-12.html - contains Pacific
Bell's 4 page Telecommuting and Resource Access Security
Checklist of questions to consider when creating a telecommuting
security policy.