Best listening experience is on Chrome, Firefox or Safari. Subscribe to Federal Drive’s daily audio interviews on Apple Podcasts or PodcastOne.

It’s fair to say the National Security Agency has more stringent cyber security requirements than the average cat. But like other agencies, it’s doing more online collaboration these days. That’s why it put together a guide to choosing and using conferencing and other collaboration tools securely. NSA Cybersecurity Directorate Technical Director Neal Ziring gave Federal Drive with Tom Temin more details.

Interview transcript:

Tom Temin: Mr. Ziring, good to have you on.

Neal Ziring: Thanks, Tom, it’s good to be here.

Tom Temin: Is it correct to say that even the NSA does have people teleworking? I know a lot of people need to be in the SCIFs and so forth in the intelligence community, but you do have some teleworking going on also?

Neal Ziring: Well, I can’t go into detail on that, Tom. But you know, we’re having to react to this crisis like everyone else, and both ourselves and everyone across the national security community that we serve is trying their best to keep their workforce safe while continuing to do their vital national security missions. And collaboration is always a part of that.

Tom Temin: Sure. So lots of federal agencies from the least secure to the most secure are using all kinds of collaboration tools. Give us what are the big security requirements and considerations for these types of tools?

Neal Ziring: Sure, you know, we were watching this, we were supporting all sorts of DoD workforce efforts. And we noticed there was a vacuum in terms of guidance to help people use collaboration services securely. So, you know, we have a great deal of deep expertise here in our workforce on this. So we put together what we thought were core requirements that individuals who maybe were suddenly trying to work from home or from some remote location could pick up and use to choose a collaboration service that would meet their own security needs. For example, does it use good encryption? Does it have ability to use multi factor authentication, can the user see and control who connects? These are all very important requirements for selecting a service that you’re going to use for government work.

Tom Temin: Because you have a list of about seven cybersecurity aspects of these – encryption, two different levels of encryption and so on, and there’s a “yes” or “no” according to each one – are there any particular characteristics that if they get a “no” at, that product would be just simply ruled out all together?

Neal Ziring: Well, we didn’t want to go there. We didn’t want to be prescriptive because the needs of different agencies vary widely. We wanted to inform folks across the national security spectrum of which requirements they should consider. I don’t think any of them are sort of showstoppers in that sense. They’re all reasonably important, and they’re going to vary between different folks. For example, there are some folks in DoD I know where the authentication is a very important concern for them. So for them, criterion number three – use a multi-factor authentication – will be vital. And we just wanted to inform them and have a representative list of products – it’s not a comprehensive list – showing what they should consider and what they should ask of the products that they start to use.

        Read more: Cybersecurity

Tom Temin: Basically, it looks like the only thing that doesn’t encrypt or use multi factor authentication or do anything is plain old SMS text, which is not really a brand, but that’s what everybody’s got on their phones.

Neal Ziring: Yeah, we threw that in as a comparison. We’re really hoping people will choose to use more secure means than their SMS.

Tom Temin: And then coming up with the list and the different ratings for the different “yes” or “no” answers on the different aspects of security on these products, did you just get that from the product literature? Or did you test them?

Neal Ziring: For the most part, we got it from the product literature, because we noticed this vacuum. We had received multiple sort of time sensitive requests from customers across Dod and other national security establishments saying, “Hey, we need some help here.” So we got together a team of folks. We did some testing and a whole lot of reading of product literature under conditions emulating what a teleworking user would face. And then we put these together and we invite the folks who maintain these systems, if they spot an inaccuracy in what we’ve published then they can write to us, and we will correct it. We’ve already gone through one round of revision.

Tom Temin: Got it. We’re speaking with Neal Ziring, the technical director of the Cybersecurity Directorate at the National Security Agency. And have you heard from any agencies that said, “Hey, this happened to us” with this particular product, you better be aware of that potential?

Neal Ziring: No, we haven’t received reports of actual incidents. We have had several national security organizations write to us and say the guidance is helpful and asking additional technical questions. That’s pretty standard for us.

Tom Temin: Sure. And I have a question about these products, too. Suppose someone in a national security situation is teleworking and collaborating over these and let’s postulate that no data is being exchanged. Say no documents or something would be exchanged back and forth in that manner. Because it may be against the rules, and depending on the sensitivity of the data, but people are talking. If they were to be talking about something that could be classified or make a reference is one of the issues that voice could be somehow obtained by a third party that’s not authorized?

        Want to stay up to date with the latest federal news and information from all your devices? Download the revamped Federal News Network app

Neal Ziring: Yeah, that’s certainly a concern for this category of product, right. Now, we do caution folks to think about what they’re saying over these systems. These are unclassified systems. And so they shouldn’t be talking classified over them in any case. But yeah, that’s why criterion number one is important, for example, right? Is this something that employs encryption, so that if there’s somebody who can see that traffic, then they’re not going to see anything but ciphertext. That’s a very important part of selecting a secure collaboration service.

Tom Temin: Let me ask you this. If you could design a ideal product in terms of cybersecurity for collaboration, what would it look like?

Neal Ziring: Oh, I think it would, it would look a lot Like some of the commercial products that are out there, now, there’s some really good ones. It should implement strong encryption, and that encryption should meet published encryption standards. It should support multi-factor authentication. A really important aspect is transparency, the service should let you see who is connected, see where it’s connecting through. Allow you to see what data you have stored in the service and delete it. And also whether the service provider is going to be sharing data about you or your usage with any third parties. That’s a concern as well.

Tom Temin: And one of the criteria is whether the source code is shared, the public source code is shared. What is the consideration there? Why is that important?

Neal Ziring: Yeah, that is that is criterion number seven. And that’s an aspect of transparency, right that lets reviewers or potentially someone like NSA, examine how the product is implementing its security and see that that is being done correctly.

Tom Temin: There’s probably some good guidance for the vendors. There’s one here called Signal which I’m not familiar with, but it gets yes’s on all of the criteria, except FedRAMP. It seems like that company ought to go for its FedRAMP certification.

Neal Ziring: Well, I would encourage any companies that want to provide service of this kind to the federal government to consider FedRAMP. I was there when they started FedRAMP. I think it’s a great program. FedRAMP is important because in gaining a FedRAMP certification, a company needs to thoroughly document how their security works and how it’s provided. And then the federal government can have more faith or more assurance when they’re utilizing that service.

Tom Temin: With respect to video, does video add cybersecurity risk in general to the use of these products?

Neal Ziring: I don’t think it adds risks in and of itself. For some of the products, using video may affect whether you get to use encryption or not. So that’s an important consideration but no, otherwise, go ahead and do the video. It’s fine.

Tom Temin: All right. Neal Ziring is technical director of the Cybersecurity Directorate at the National Security Agency. Thanks so much for joining me.

Neal Ziring: Thank you, Tom.

Read more information here.

Copyright © 2024 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.