- New guidance from the Five Eyes Alliance outlines edge device expectations
- Cybersecurity agencies from the UK, Canada, and Australia and more publish recommendations
- The guidance is primarily for edge device manufacturers
The Five Eyes Alliance, a group of cybersecurity agencies from the UK, Australia, Canada, New Zealand, and the US, have come together to issue cybersecurity guidance for device manufacturers.
With critical infrastructure sustaining 13 cyberattacks per second in recent years, mitigating the effects of compromises is a priority at every stage.
The new recommendations are for manufacturers of network edge devices and appliances such as routers, firewalls, virtual private network (VPN) gateways, Internet of Things (IoT) devices and more.
Manufactured vulnerabilities
The aim of the advice is to help network defenders ‘secure organisational networks both before and after a compromise’ and to set expectations for the minimum requirements for forensic visibility. This will enable network defenders to more easily detect and investigate malicious activity.
The four sets of published requirements include the UK NCSC’s digital forensics guidance, Canada’s CCCS edge device security considerations, and from the Australian ACSC, both mitigation strategies and practitioner guidance.
Threat actors have been known to exploit flaws in edge devices to gain access to networks – so securing these devices will be crucial in the fight against cybercrime.
Edge devices usually have public IP addresses that can be reached from anywhere, and are particularly vulnerable to hackers because they handle important information and connect to external networks directly.
Included in the guidance are logging requirements, setting out the minimum expectations for threat detection and detailed event recording, and forensic data acquisition requirements, like volatile data collection to help facilitate automatic analysis and helping human investigators detect anomalous events.
“Device manufacturers are encouraged to include and enable standard logging and forensic features that are robust and secure by default, so that network defenders can more easily detect malicious activity and investigate following an intrusion,” said the UK’s National Cyber Security Centre.
