NIST releases telnet, IT security drafts

NIST draft publications

Related Links

Federal agencies desiring to minimize work disruptions from outside intrusions can begin with simple safeguards, such as preventing unauthorized users from using the telnet protocol to gain access to a server, according to officials at the National Institute of Standards and Technology.

Draft documents on computer security released Jan. 22 by the National Institute of Standards and Technology give an example of how unauthorized telnet users simply identify themselves as a guest to gain access to sensitive government files.

The Risk Management Guide for Information Technology Systems suggests that disabling telnet is about a 10-hour procedure. Practical advice in the 58-page document includes other ways that agencies can develop standards for safeguarding sensitive but unclassified information in federal computer systems. As applied to information systems, the guide says, risk management is a responsibility of executive managers to be shared with technical managers, and not a technical manager's sole responsibility.

Engineering Principles for Information Technology Security, a 33-page document also released this week, offers an overview of accepted principles and practices for security information technology systems.

With the release of both documents in draft form, NIST said it will accept suggestions for revisions until March 20. Those comments can be sent electronically to [email protected]

Featured

  • Workforce
    Avril Haines testifies SSCI Jan. 19, 2021

    Haines looks to restore IC workforce morale

    If confirmed, Avril Haines says that one of her top priorities as the Director of National Intelligence will be "institutional" issues, like renewing public trust in the intelligence community and improving workforce morale.

  • Defense
    laptop cloud concept (Andrey Suslov/Shutterstock.com)

    Telework, BYOD and DEOS

    Telework made the idea of bringing your own device a top priority as the Defense Information Systems Agency begins transitioning to a permanent version of the commercial virtual remote environment.

Stay Connected