NSA Network Infrastructure Security Guidance [pdf]

Re:NSA Network Infrastructure Security Guidance [pdf] by FourthProtocol on Sunday March 06, 2022 @02:37AM (#30575759)

I have some experience here, not with the NSA though. BYOD is forbidden, and checked when you enter the building. There is only wired hardware - and wireless is, well, jammed. Any software introduced into such networks is vetted before introduction/deployment. It takes time. 3rd party apps don't auto update - Microsoft for example provide updates that can be vetted before being allowed onto the network.

And this is only some bleedingly obvious stuff...

The document does not describe SECRET or TOP SECRET environments. Not even RESTRICTED. R, S and TS policies are themselves marked with protective markings, which this PDF lacks.

Governments have a lower level of protection called PROTECTED or similar that is closer to what the document describes, but even that would be protectively marked...

Looks to me like NSA is sharing some of their lesser sensitive stuff to possibly help their vendors, businesses partners and public at large. Kind of like "we recommend Joe Public do it like so..."

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by mike_d on Sunday March 06, 2022 @03:40AM (#30576042)

To clarify a bit, you are talking about classifed network design. That isn't what this document is about.

The author of this document, Information Assurance Directorate (www.iad.gov) is focused on helping domestic government, their contractors, and private industry secure networks and devices against intrusion from hostile actors.

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by FourthProtocol on Sunday March 06, 2022 @05:55AM (#30576616)

I'm talking about op-sec. Network design is but a single aspect of that, and often doesn't feature at all. I mean this more in the sense described by Wikipedia¹, and not the likes of SecurityStudio²/Fortinet³ (first two search results).

¹ https://en.wikipedia.org/wiki/Operations_security ² https://securitystudio.com/operational-security/ ³ https://www.fortinet.com/resources/cyberglossary/operational...

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by greggsy on Sunday March 06, 2022 @08:09AM (#30577353)

I’m not sure how that’s relevant?

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by FourthProtocol on Tuesday March 08, 2022 @10:56AM (#30601303)

It's relevant because your GP asked specifically whether I was talking about network design.

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by greggsy on Sunday March 06, 2022 @08:08AM (#30577347)

The point of the document is for industry and public consumption, not spooks. The GCHQ, ACSC and other agencies release similar publications.

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by znpy on Sunday March 06, 2022 @05:30AM (#30576505)

> and wireless is, well, jammed

Uhm... wouldnt this, like, kill people with a pacemaker ?

I was always told that jammers are dangerous for people with a pacemaker.

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by dijit on Sunday March 06, 2022 @05:37AM (#30576532)

The way it's usually implemented is two sides of a wall have a mesh in them, similar to chicken wire.

Jams all signals, doesn't require a beacon to be constantly transmitting.

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by rzzzt on Sunday March 06, 2022 @07:35AM (#30577148)

I'd assumed "jamming" is when something actively disrupts communication, not passively prohibits the signal from reaching its intended recipient, which sounds more like "shielding".

(Maybe this is unnecessary nitpicking, and everyone else understands that it was informal; English is not my first language.)

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by InCityDreams on Sunday March 06, 2022 @09:53AM (#30577921)

Native English speaker: you're correct (ie, i agree with you).

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by alufers on Sunday March 06, 2022 @05:47AM (#30576583)

So it's a faraday cage?

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by dijit on Sunday March 06, 2022 @05:49AM (#30576595)

Yes, but part of the infrastructure of the building.

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by aborsy on Sunday March 06, 2022 @03:22AM (#30575959)

Are there guidelines on how to secure S and TS environments?

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by greggsy on Sunday March 06, 2022 @08:14AM (#30577371)

There’s heaps of content in the NIST 800- series, which is all available online

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by greggsy on Sunday March 06, 2022 @08:15AM (#30577378)

It’s covered in the NIST 800 series, which is available online

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by FourthProtocol on Sunday March 06, 2022 @03:33AM (#30576004)

Yes. I assume you're asking if they're publicly available, which is a no. Is not an easy world to penetrate, for good reason.

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by faeyanpiraat on Sunday March 06, 2022 @04:10AM (#30576160)

Your website has great structure to communicate your values effectively; it must’ve helped you land some great opportunities.

[ Parent | on HN ]

Re:NSA Network Infrastructure Security Guidance [pdf] by FourthProtocol on Sunday March 06, 2022 @06:01AM (#30576645)

Thank you. The only value I set out with when building the more recent version of the site was to share what I know. Too many people learn a thing and keep it to themselves.

[ Parent | on HN ]