NIST SP 800-46 Rev 2 Enterprise Telework, Remote Access and BYOD Security
Section 3: Remote access solution security – NIST SP 800-46 Rev 2 Enterprise Telework, Remote Access and BYOD Security

NIST SP 800-46 Rev 2 Enterprise Telework, Remote Access and BYOD Security 3.3.3: Protect remote access communications with approved cryptography and consider disabling split tunnelling

What does 3.3.3 require?

At a minimum, sensitive information crossing the Internet, wireless or other untrusted networks has its confidentiality and integrity protected by cryptography, with both ends of a FIPS 140 compliant system validated; remote access methods that lack NIST-approved mechanisms get additional approved protection such as a tunnel, and methods offering both approved and non-approved algorithms have the non-approved ones disabled where possible. For VPN users on untrusted networks, particularly wireless hotspots, the organisation considers disabling split tunnelling so an attacker on the local network cannot reach the device while it is connected.

Maintained by Gerard Blokdyk

Other controls in Section 3: Remote access solution security – NIST SP 800-46 Rev 2 Enterprise Telework, Remote Access and BYOD Security

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-46 Rev 2 Enterprise Telework, Remote Access and BYOD Security controls