# NSA Cybersecurity Publications All documents at media.defense.gov. GitHub repos at github.com/nsacyber. ## Core Network Security ### Network Infrastructure Security Guide (CTR, Oct 2023) - PDF: https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF - Covers: Network architecture, AAA, routing protocols, VLAN segmentation, port security, remote logging, monitoring, administration - The single most comprehensive NSA document on network infrastructure ### Hardening Network Devices (Aug 2020) - PDF: https://media.defense.gov/2020/Aug/18/2002479461/-1/-1/0/HARDENING_NETWORK_DEVICES.PDF - Covers: Disabling unnecessary services, securing management interfaces, firmware updates, password policies, SSH config (min 3072-bit RSA), SNMP hardening ### Cisco Firepower Hardening Guide (Aug 2023) - PDF: https://media.defense.gov/2023/Aug/02/2003272858/-1/-1/0/CTR_CISCO_FIREPOWER_HARDENING_GUIDE.PDF ## Network Segmentation ### Segment Networks and Deploy Application-Aware Defenses (Sep 2019) - PDF: https://media.defense.gov/2019/Sep/09/2002180325/-1/-1/0/Segment%20Networks%20and%20Deploy%20Application%20Aware%20Defenses%20-%20Copy.pdf ### Implement Network Segmentation in Cloud Environments (Mar 2024) - PDF: https://media.defense.gov/2024/Mar/07/2003407861/-1/-1/0/CSI-CloudTop10-Network-Segmentation.PDF ## VPN Hardening ### Configuring IPsec Virtual Private Networks (v1.3, Feb 2025) - PDF: https://media.defense.gov/2021/Sep/16/2002855928/-1/-1/0/CONFIGURING_IPSEC_VIRTUAL_PRIVATE_NETWORKS_2020_07_01_FINAL_RELEASE.PDF - Covers: CNSSP 15-compliant algorithms (DH group 16, AES-256, SHA-384), IKE/IPsec config, eliminating weak ciphers - The definitive government standard for IPsec VPN configuration ### Selecting and Hardening Remote Access VPN Solutions (Sep 2021, joint NSA/CISA) - Landing: https://www.nsa.gov/Resources/Multimedia/igphoto/2002863206/ - Covers: VPN product selection criteria (prefer IKE/IPSec over SSL/TLS VPNs), MFA enforcement, patching cadence ## Zero Trust ### Embracing a Zero Trust Security Model (Feb 2021) - PDF: https://media.defense.gov/2021/Feb/25/2002588479/-1/-1/0/CSI_EMBRACING_ZT_SECURITY_MODEL_UOO115131-21.PDF ### Advancing Zero Trust Maturity -- Seven Pillar Series (2024) - Network and Environment: https://media.defense.gov/2024/Mar/05/2003405462/-1/-1/0/CSI-ZERO-TRUST-NETWORK-ENVIRONMENT-PILLAR.PDF - Data: https://media.defense.gov/2024/Apr/09/2003434442/-1/-1/0/CSI_DATA_PILLAR_ZT.PDF - Application and Workload: https://media.defense.gov/2024/May/22/2003470825/-1/-1/0/CSI-APPLICATION-AND-WORKLOAD-PILLAR.PDF - Visibility and Analytics: https://media.defense.gov/2024/May/30/2003475230/-1/-1/0/CSI-VISIBILITY-AND-ANALYTICS-PILLAR.PDF - Automation and Orchestration: https://media.defense.gov/2024/Jul/10/2003500250/-1/-1/0/CSI-ZT-AUTOMATION-ORCHESTRATION-PILLAR.PDF ### Zero Trust Implementation Guideline Primer (Jan 2026) - PDF: https://media.defense.gov/2026/Jan/08/2003852320/-1/-1/0/CTR_ZERO_TRUST_IMPLEMENTATION_GUIDELINE_PRIMER.PDF ### Zero Trust Implementation Guide Phase One (Jan 2026) - PDF: https://media.defense.gov/2026/Jan/30/2003868308/-1/-1/0/CTR_ZIG_PHASE_ONE.PDF ## DNS Security ### Selecting a Protective DNS Service (v1.3, Mar 2025) - PDF: https://media.defense.gov/2025/Mar/24/2003675043/-1/-1/0/CSI-Selecting-a-Protective-DNS-Service-v1.3.PDF ### Adopting Encrypted DNS in Enterprise Environments (Jan 2021) - PDF: https://media.defense.gov/2021/Jan/14/2002564889/-1/-1/0/CSI_ADOPTING_ENCRYPTED_DNS_U_OO_102904_21.PDF - Covers: DoH/DoT deployment, blocking outbound port 53/853 to prevent bypass ### Defending Your DNS Infrastructure (Jul 2019) - PDF: https://media.defense.gov/2019/Jul/16/2002158054/-1/-1/0/DEFENDING%20YOUR%20DNS%20INFRASTRUCTURE_BANNERLESS%20.PDF ## TLS/SSL ### Eliminating Obsolete TLS Protocol Configurations (Jan 2021) - Press: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2462345/ - GitHub (detection tools, configs): https://github.com/nsacyber/Mitigating-Obsolete-TLS - Only TLS 1.2/1.3 permitted. SSL 2.0/3.0 and TLS 1.0/1.1 must be eliminated. ## Wireless ### WPA3 Cybersecurity Technical Report (Jul 2019) - PDF: https://media.defense.gov/2019/Jul/16/2002158109/-1/-1/0/CTR-CYBERSECURITY-TECHNICAL-REPORT-WPA3.PDF ## Strategy and Top-Level ### Top Ten Cybersecurity Mitigation Strategies - PDF: https://media.defense.gov/2019/Jul/16/2002158046/-1/-1/0/CSI-NSAS-TOP10-CYBERSECURITY-MITIGATION-STRATEGIES.PDF ### Top Ten Cybersecurity Misconfigurations (Oct 2023, joint NSA/CISA) - PDF: https://media.defense.gov/2023/Oct/05/2003314578/-1/-1/0/JOINT_CSA_TOP_TEN_MISCONFIGURATIONS_TLP-CLEAR.PDF - Based on real red/blue team assessments ### Enhanced Visibility and Hardening Guidance for Communications Infrastructure (Dec 2024) - PDF: https://media.defense.gov/2024/Dec/03/2003596322/-1/-1/0/JOINT-GUIDANCE-ENHANCED-VISIBILITY-HARDENING-GUIDE-FOR-COMMS-INFRASTRUCTURE.PDF - Anti-Salt Typhoon (PRC threat actors targeting telecom) ## Other ### Kubernetes Hardening Guide v1.2 (Aug 2022) - PDF: https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF ### Hardening SIEM Solutions (Oct 2019) - PDF: https://media.defense.gov/2019/Oct/30/2002203425/-1/-1/0/HARDENING%20SIEM%20SOLUTIONS_20191008-NSAGOV.PDF ## NSA GitHub (github.com/nsacyber) - Publications index: https://nsacyber.github.io/publications.html - Open source tools: https://nsacyber.github.io/opensource.html - Mitigating-Obsolete-TLS: detection tools and configs - Hardware-and-Firmware-Security-Guidance: Spectre/Meltdown, Secure Boot - Unfetter: ATT&CK framework-based defensive gap identification - Certificate-Authority-Situational-Awareness: rogue CA detection