In December 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released a critical guide titled “Enhanced Visibility and Hardening Guidance for Communications Infrastructure.” This publication, in collaboration with the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and international partners, addresses significant cyber espionage activities by threat actors affiliated with the People’s Republic of China (PRC), who have compromised networks of major global telecommunications providers. This is a follow-up to the statement issued by CISA in November of this year.

Key Recommendations:

Strengthening Visibility:

• Network Monitoring: Implement comprehensive monitoring to detect unauthorized changes, strange behaviors, and potential threats within network devices such as switches, routers, and firewalls.

• User Activity Surveillance: Regularly monitor user and service account logins for anomalies, validate all accounts, and promptly disable inactive ones to minimize the attack surface.

• Centralized Logging: Utilize secure, centralized logging systems capable of analyzing and correlating data from various sources. Ensure logs are encrypted and stored off-site to prevent tampering.

Hardening Systems and Devices:

• Out-of-Band Management: Employ physically separate management networks to prevent lateral movement in case of a device compromise.

• Access Control Lists (ACLs): Adopt a strict, default-deny ACL strategy to control inbound and outbound traffic, ensuring all denied traffic is logged.

• Network Segmentation: Implement robust network segmentation using router ACLs, stateful packet inspection, and demilitarized zones (DMZs). This will isolate different device groups effectively.

• Protocol Security: Disable unnecessary services and protocols like Telnet and SNMP v1/v2c. Verify that required services are adequately protected and fully patched.

• Multi-Factor Authentication (MFA): Enforce phishing-resistant MFA for all accounts accessing company systems, networks, and applications, including administrative access to routers.

These measures are designed to enhance network defenders to monitor, detect, and understand activities within their networks. This can assist thereby reducing vulnerabilities and limiting potential entry points for cyber threats.

For a comprehensive understanding of these recommendations and to access the full guidance, please visit CISA’s official publication.

Implementing these best practices is crucial for safeguarding our communications infrastructure against evolving cyber threats. At Breach Secure Now, we are committed to providing you with the latest insights and guidance. To learn more about how we can help your MSP to elevate their offering, contact us today.