CIS Controls Version 8.1 Telework Security Software User Guide

CIS Controls Version 8.1 Telework Security Software

Telework Security Checklist
The items in the following checklist are top security priorities for your home network. It is possible that some of the items below are not applicable to your situation. Do your best; some is better than none.

• Change your Wi-Fi password to something unique: Unique and long passwords prevent unauthorized access to your home network. This helps keep your online activities private and avoids others using your network for inappropriate activities.
• Change the default password of your router and modem: Default router and modem passwords are easily found on the internet. Changing these passwords prevents someone from accessing your home network devices.
• Use a unique password to access your internet provider’s web portal: Your internet provider’s website contains private information and control settings of your home network devices.
• Enable automatic updates for all routers and modems: Devices that don’t receive regular updates are insecure and are more likely to be hacked.
• Turn on WPA2 or WPA3: These encryption settings keep prying eyes from watching your internet activity.
• Enable multi-factor authentication (MFA) wherever possible: Enable MFA on your internet service provider (ISP) web portal, router, modem, or mobile app whenever possible for added security.
• Ensure your Wi-Fi network name does not provide identifying information: Avoid using personal information in your Wi-Fi network name, such as your name, address, or device model.
• Enable the router and modem firewall: These features can help prevent dangerous requests and malware from infecting your home network.
• Disable Wi-Fi Protected Setup (WPS) if possible: WPS is an outdated way of connecting devices to your network via a button on the back or bottom of your router. It can be easily abused to connect unauthorized devices to your home network.
• Turn off the 2.4 GHz or 5 GHz network if you don’t need it: Many routers turn on multiple networks. If you’re not using both, disable either the 2.4 GHz or 5 GHz network. This can reduce potential access points for unauthorized individuals. Only enable the guest network if needed.
• Move all routers and modems to a location not accessible to house guests: Place routers and modems in a secure location out of reach of house guests, as physical access could allow unauthorized devices to connect to your network.

Telework Security Guide

• This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International Public License (the link can be found at https://creativecommons.org/licenses/by-nc-nd/4.0/legalcode).
• To further clarify the Creative Commons license related to the CIS Controls® content, you are authorized to copy and redistribute the content as a framework for use by you, within your organization and outside of your organization for non-commercial purposes only, provided that (i) appropriate credit is given to CIS, and (ii) a link to the license is provided. Additionally, if you remix, transform, or build upon the CIS Controls, you may not distribute the modified materials. Users of the CIS Controls framework are also required to refer to (http://www.cisecurity.org/controls/) when referring to the CIS Controls in order to ensure that users are employing the most up-to-date guidance. Commercial use of the CIS Controls is subject to the prior approval of
• Center for Internet Security, Inc.® (CIS®).

Acknowledgments

CIS would like to thank the many security experts who volunteer their time and talent to support the CIS Controls and other CIS work. CIS products represent the effort of a veritable army of volunteers from across the industry, generously giving their time and talent in the name of a more secure online experience for everyone.

Editors

• Joshua M Franklin, CIS
• Darren Freidel-Stevenson, CIS
• Eric Pinnell, CIS

Contributors to Previous Versions of this Guide

• Aaron Piper, CIS
• Alan B. Watkins, ABW Consulting Services
• Stephen Campbell, Non-State Threat Intelligence, LLC
• Uros Trnjakov, Oxfam GB
• Maurice Turner, Center for Democracy and Technology (CDT)
• Michael K Wicks, CIS
• Robin Regnier, CIS
• Phil Langlois, Verizon

Introduction

• Teleworking is now commonplace, and employers are increasingly relying upon remote employees to responsibly handle enterprise information at their homes. Yet employers generally have little visibility into how the personal networks of their employees are secured. Unfortunately, a poorly configured home network can affect the security of an entire organization if sensitive information is made public. This guide exists to help teleworkers and remote employees secure their home networks by offering easy to follow guidance.
• Securing the home office starts with how laptops, phones, and desktops are connecting to the internet. Routers and modems are the devices that make this possible. These devices need to be purchased with security in mind and managed properly to provide a safe home environment. Additionally, settings within these devices can be configured to significantly boost security. Proper setup, care, and maintenance of these devices is required. That includes personal and family data, and any enterprise data stored within their home office.

Purpose

This guide is meant to assist individuals in securing commodity routers, modems, and other home network devices. Insecure routers and modems can lead to serious cybersecurity consequences for people and the businesses they work for. For instance:

• If someone can access your network, they may be able to read sensitive company files like tax information, personally identifiable information (PII) about employees, and other proprietary information that should not be shared with someone outside of the business.
• If routers or computers in a network are compromised, they may become part of a botnet, which can be used to attack other computer systems and organizations connected to the internet.
• If a company doesn’t keep in line with industry norms in terms of cybersecurity, they may be liable for breaches and data loss.
• If a company maintains cybersecurity insurance or is contemplating such insurance, most insurers require the company to have adequate and reasonable security measures in place to protect both company and customer information.

Audience

• This guide is designed to help teleworkers and remote employees secure their home networks. It is especially useful for those who do not have a technical background. The goal is to provide practical guidance to protect home office environments while allowing flexibility to adapt these recommendations to your unique needs. This guide is not meant to override any technical or security guidance provided by an employer.
• The focus of this guide is on networking equipment an average person can purchase in-store or online. These devices are not equivalent in terms of security when compared to “enterprise-grade” equipment used by businesses. Accordingly, these “enterprise-grade” devices are not covered by this guide. They often have a much higher price tag and require specialized technical expertise to use and maintain. Instead, this guide is scoped to setup, operation, and maintenance of commodity network devices and does not assist with advanced networking equipment.

Document Structure

This guide begins by providing the necessary information for teleworking and remote employees to purchase devices. This is followed by the general process for setting up and securing those devices for home use. Although not for everyone, the advanced configuration areas are there for those people who want additional protection for their home networks. Finally, we discuss the signs that your device may be in need of an upgrade. Specific sections of this guide include:

• Purchasing a network device
• Basic device setup
• Basic network setup
• Encrypting your traffic
• Advanced configuration settings
• End of life considerations

The following appendices are also provided:

• Acronyms and abbreviations
• References
• Links to other guidance from external, trusted sources

This document structure is meant to follow the same lifecycle that a person would experience when purchasing a modem or router for home use. They would research the device, purchase said device, and then begin setting it up. This would include setting up a network and potentially additional configuration of the device itself. Finally, the device would be retired at some point when an upgrade is necessary, or the device no longer functions properly.Purchasing a Home Network Device

With few exceptions, once a router, modem, or other home network device is purchased, it’s generally not possible to add additional security features. This means that the right device for your home office needs to be researched, vetted, and reviewed before the device is bought and paid for. There are many places to purchase network devices, such as in-person or online from a well-known electronics store or directly from an internet provider. The most important thing is to obtain your device from a reputable source. Purchasing a used device could introduce a potential risk in that someone else may already know the passwords to the device. Additionally, someone may have installed malicious code or a backdoor on the device to compromise its security and steal your data.  A used device may also be more likely to break, leaving the user without any vendor support or warranty to receive a new device. Let’s discuss the types of home network devices you may need in your home network.

• Buy your router and modem from a reliable source. Avoid secondhand purchases.

Types of Home Network Devices

• There are many terms for home network devices and the names of each are often used interchangeably. This causes a lot of confusion for people without an information technology background. To help assist, the following sections define common terminology and ensure teleworkers and remote employees understand what they are purchasing. When considering a new purchase, don’t be afraid to ask questions of an electronics store employee or a friend or family member with a technical background. If you’re concerned about anything, you can always verify information on the device manufacturer’s website.

Modem

• An internet service provider (ISP) is the company you pay to access the internet. A modem communicates with your ISP’s network and is the main device needed to connect your home to the internet. The modem is often supplied by the ISP, although it can be cheaper over time to purchase and manage the modem yourself. At that point, the ISP will need access to configure, troubleshoot, and operate the device. Note that modems may be also referred to as the cable box or digital subscriber line (DSL) modem.

Router

• A router is a network device that typically manages an internal network, acting as an overall network hub. In a home office setting, routers connect directly to the modem via a physical (often blue) Ethernet cable and will commonly be located behind the modem (e.g., closer to the internal network). Although older routers may only use physical Ethernet cables, modern routers are wireless access point (WAP) that enable smartphones, tablets, and laptops to wirelessly connect to your home network.

Modem and Router Hybrids

• Although routers and modems were originally two separate devices, most modern store-bought or ISP-provided modems have a router built into them. These devices may be confusingly referred to as a “modem” or a “router,” and research is necessary to identify if a device is a hybrid or combination model. They can also be known as a gateway. For an average, non-technical individual, combination modem routers may be the best option from an ease-of-use perspective. Modem and router hybrid devices will often need to be rented from your ISP, so they may be more expensive over the lifetime of the device.

Mesh Routers

• Mesh routers are the new kid on the block when it comes to home networks. Multiple mesh routers are commonly sold in a set of 3, and they all act in tandem to support a larger Wi-Fi network. These devices are ideal for people that have a large physical area that needs Wi-Fi coverage (i.e., a big house), or have large objects in the way (e.g., refrigerators, washing machines). Also, some houses may have metal, sand, dirt, and stone as part of their home, all of which make it difficult for Wi-Fi radio waves to propagate.
• This impacts signal strength and coverage. Mesh routing ultimately allows you to have good Wi-Fi signal throughout your home.
• Multiple mesh routers act as one network so there is no need to switch to different networks even though you are setting up multiple different routers. Mesh networks also add redundancy by ensuring that even if one router fails you will still have a portion of your Wi-Fi network up and running. Adding additional routers is often as simple as scanning a QR code through a mobile app and plugging the device into power. Many mesh routers have a physical connection port in the back that will allow for faster speeds and media to be shared across the network.

Example Home Network Architectures

• The following graphics show how home network devices are typically used in a home setting. This first graphic shows a simple home network architecture. In this architecture, a router and modem hybrid device are used to connect the home to their ISP. All phones, laptops, tablets, and printers in the home connect to the router and modem hybrid device via Wi-Fi. It is a simple and effective setup that is used quite commonly.

• In this second graphic, a standalone modem is used to connect the house to the internet via the ISP. A mesh network is used for all devices to communicate internally via Wi-Fi. Note that at least one of the mesh network devices is hardwired into the modem via a physical Ethernet cable. Note that all of the devices in the house are connecting to whichever mesh router they are physically closest to via Wi-Fi. All of the mesh routers are also communicating with each other and sending data to other mesh routers along the path as needed.

Desired Security Features

The home network device market is quite competitive, and new features are added all the time to help devices stand out from the crowd. The following are examples of security-relevant features that may come when researching a new home network device. While not all of these are critical to home network security, these are the items recommended by CIS that are worth considering when making a new purchase.

Multi-factor authentication (MFA) provides an additional layer of security in case your password is compromised. An attacker will need an additional form of authentication, such as a PIN from a text message or a code from a mobile app.

• Auto-update: Enabling this ensures that you will always be up-to-date with critical patches and security fixes. This feature reduces your risk of compromise due to outdated software.
• Multi-factor authentication (MFA): MFA can be enabled on some network devices to ensure that the person accessing the device is supposed to have access.
• Wireless Protected Access 3 (WPA3): WPA3 is a new Wi-Fi security feature containing new authentication and encryption protocols that can help prevent attackers from spying on traffic or successfully attacking a router.
• Guest network: Guest networks can act as a dividing line between trusted devices and untrusted devices. They also provide a way to offer network access to house guests without providing the primary Wi-Fi network password to that person. A temporary password can be given that is removed or times out at a later date.
• Built-in firewall: A firewall helps to block malicious traffic from reaching any devices on the internal network.
• Virtual Private Network (VPN) Access: This feature can allow or block third-party VPNs from working on a network. Although not critical to the security of the device and network, it is useful in some situations. Some companies may require the use of a VPN from a home office.

For individuals looking for a more in-depth technical resource, look to NSA Telework and Mobile Security Guidance, Secure Your Wi-Fi and router, and routersecurity.org for additional information.

Basic Device Setup

• After removing a new home network device from the packaging, consider registering it with the device manufacturer. This will help to ensure the device warranty is properly registered in case there’s an issue with the device in the future. It may also be prudent to store any physical items such as universal serial bus (USB) drives or credentials that ship with the device (e.g., passwords) in a safe place. They can be useful to reset the router to factory settings or resell the device once you’re done using it.
• If the ISP is setting up your home internet service, they will most likely configure the home network device in a reasonable manner. However, you need to find out how to add, change, or disable administrative accounts and how to change passwords. This will often require getting a password from your ISP. Otherwise, after plugging the device in a power source, it will likely boot-up and activate a wireless network once the ISP connection is active. Be sure to investigate and configure all Wi-Fi networks turned on by the manufacturer by default. You may want to disable any network enabled by the ISP. Finally, there may be some device manufacturers that require the user to sign up for an account, to use the router.

Initial Device Setup

• The device’s user manual will specify a method of accessing the administrative portal. This is where a router’s configuration settings can be modified. The most common methods of accessing the portal are via an application or a web page. Using an application to control the router limits the computer systems that can access the router, which can be useful. The more common method is to open a browser and access the administrative portal via a specific web address such as https://192.168.1.1 or https://192.168.0.1.
• Again, this will be different for every device. If managing the router through the webpage, it’s more secure to perform administrative activities via a wired connection like Ethernet in lieu of Wi-Fi.

Internal and External Network Interfaces

• Routers and modems are equipped with multiple network interfaces. A router needs a network interface for each connected network. Routers connect to an external and internal network. They act as a gateway between your ISP’s network (the external interface) and your home network (the internal interface). Some devices have separate passwords for both of these interfaces, but not all will.
• The ISP will always need to access the external interface to provide you with internet. Be aware of the types of access provided by a router and attempt to control access to the extent possible. Using a firewall in combination with a router (often on the same network device) can help control external devices from accessing the internal network. Here is a graphic depicting the internal and external interfaces of a modem.

Using and Managing Passwords

Passwords are the main credential used to access the network device through a process known as authentication. The admin password used to configure the network device should be changed from the factory setting to something unique and shared with as few people as possible. Even at home, you should use strong passwords, meaning they are 8 characters or greater in length. Here are CIS’s password strength recommendations.

• Change the passwords that come with your router and modem. Default passwords for many router and modem models are well known and easily found online.

CIS Password Recommendations