#NSA Cybersecurity Publications

All documents at media.defense.gov. GitHub repos at github.com/nsacyber.

#Core Network Security

#Network Infrastructure Security Guide (CTR, Oct 2023)

• PDF: https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF
• Covers: Network architecture, AAA, routing protocols, VLAN segmentation, port security, remote logging, monitoring, administration
• The single most comprehensive NSA document on network infrastructure

#Hardening Network Devices (Aug 2020)

• PDF: https://media.defense.gov/2020/Aug/18/2002479461/-1/-1/0/HARDENING_NETWORK_DEVICES.PDF
• Covers: Disabling unnecessary services, securing management interfaces, firmware updates, password policies, SSH config (min 3072-bit RSA), SNMP hardening

#Cisco Firepower Hardening Guide (Aug 2023)

• PDF: https://media.defense.gov/2023/Aug/02/2003272858/-1/-1/0/CTR_CISCO_FIREPOWER_HARDENING_GUIDE.PDF

#Network Segmentation

#Segment Networks and Deploy Application-Aware Defenses (Sep 2019)

• PDF: https://media.defense.gov/2019/Sep/09/2002180325/-1/-1/0/Segment%20Networks%20and%20Deploy%20Application%20Aware%20Defenses%20-%20Copy.pdf

#Implement Network Segmentation in Cloud Environments (Mar 2024)

• PDF: https://media.defense.gov/2024/Mar/07/2003407861/-1/-1/0/CSI-CloudTop10-Network-Segmentation.PDF

#VPN Hardening

#Configuring IPsec Virtual Private Networks (v1.3, Feb 2025)

• PDF: https://media.defense.gov/2021/Sep/16/2002855928/-1/-1/0/CONFIGURING_IPSEC_VIRTUAL_PRIVATE_NETWORKS_2020_07_01_FINAL_RELEASE.PDF
• Covers: CNSSP 15-compliant algorithms (DH group 16, AES-256, SHA-384), IKE/IPsec config, eliminating weak ciphers
• The definitive government standard for IPsec VPN configuration

#Selecting and Hardening Remote Access VPN Solutions (Sep 2021, joint NSA/CISA)

• Landing: https://www.nsa.gov/Resources/Multimedia/igphoto/2002863206/
• Covers: VPN product selection criteria (prefer IKE/IPSec over SSL/TLS VPNs), MFA enforcement, patching cadence

#Zero Trust

#Embracing a Zero Trust Security Model (Feb 2021)

• PDF: https://media.defense.gov/2021/Feb/25/2002588479/-1/-1/0/CSI_EMBRACING_ZT_SECURITY_MODEL_UOO115131-21.PDF

#Advancing Zero Trust Maturity -- Seven Pillar Series (2024)

• Network and Environment: https://media.defense.gov/2024/Mar/05/2003405462/-1/-1/0/CSI-ZERO-TRUST-NETWORK-ENVIRONMENT-PILLAR.PDF
• Data: https://media.defense.gov/2024/Apr/09/2003434442/-1/-1/0/CSI_DATA_PILLAR_ZT.PDF
• Application and Workload: https://media.defense.gov/2024/May/22/2003470825/-1/-1/0/CSI-APPLICATION-AND-WORKLOAD-PILLAR.PDF
• Visibility and Analytics: https://media.defense.gov/2024/May/30/2003475230/-1/-1/0/CSI-VISIBILITY-AND-ANALYTICS-PILLAR.PDF
• Automation and Orchestration: https://media.defense.gov/2024/Jul/10/2003500250/-1/-1/0/CSI-ZT-AUTOMATION-ORCHESTRATION-PILLAR.PDF

#Zero Trust Implementation Guideline Primer (Jan 2026)

• PDF: https://media.defense.gov/2026/Jan/08/2003852320/-1/-1/0/CTR_ZERO_TRUST_IMPLEMENTATION_GUIDELINE_PRIMER.PDF

#Zero Trust Implementation Guide Phase One (Jan 2026)

• PDF: https://media.defense.gov/2026/Jan/30/2003868308/-1/-1/0/CTR_ZIG_PHASE_ONE.PDF

#DNS Security

#Selecting a Protective DNS Service (v1.3, Mar 2025)

• PDF: https://media.defense.gov/2025/Mar/24/2003675043/-1/-1/0/CSI-Selecting-a-Protective-DNS-Service-v1.3.PDF

#Adopting Encrypted DNS in Enterprise Environments (Jan 2021)

• PDF: https://media.defense.gov/2021/Jan/14/2002564889/-1/-1/0/CSI_ADOPTING_ENCRYPTED_DNS_U_OO_102904_21.PDF
• Covers: DoH/DoT deployment, blocking outbound port 53/853 to prevent bypass

#Defending Your DNS Infrastructure (Jul 2019)

• PDF: https://media.defense.gov/2019/Jul/16/2002158054/-1/-1/0/DEFENDING%20YOUR%20DNS%20INFRASTRUCTURE_BANNERLESS%20.PDF

#TLS/SSL

#Eliminating Obsolete TLS Protocol Configurations (Jan 2021)

• Press: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2462345/
• GitHub (detection tools, configs): https://github.com/nsacyber/Mitigating-Obsolete-TLS
• Only TLS 1.2/1.3 permitted. SSL 2.0/3.0 and TLS 1.0/1.1 must be eliminated.

#Wireless

#WPA3 Cybersecurity Technical Report (Jul 2019)

• PDF: https://media.defense.gov/2019/Jul/16/2002158109/-1/-1/0/CTR-CYBERSECURITY-TECHNICAL-REPORT-WPA3.PDF

#Strategy and Top-Level

#Top Ten Cybersecurity Mitigation Strategies

• PDF: https://media.defense.gov/2019/Jul/16/2002158046/-1/-1/0/CSI-NSAS-TOP10-CYBERSECURITY-MITIGATION-STRATEGIES.PDF

#Top Ten Cybersecurity Misconfigurations (Oct 2023, joint NSA/CISA)

• PDF: https://media.defense.gov/2023/Oct/05/2003314578/-1/-1/0/JOINT_CSA_TOP_TEN_MISCONFIGURATIONS_TLP-CLEAR.PDF
• Based on real red/blue team assessments

#Enhanced Visibility and Hardening Guidance for Communications Infrastructure (Dec 2024)

• PDF: https://media.defense.gov/2024/Dec/03/2003596322/-1/-1/0/JOINT-GUIDANCE-ENHANCED-VISIBILITY-HARDENING-GUIDE-FOR-COMMS-INFRASTRUCTURE.PDF
• Anti-Salt Typhoon (PRC threat actors targeting telecom)

#Other

#Kubernetes Hardening Guide v1.2 (Aug 2022)

• PDF: https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF

#Hardening SIEM Solutions (Oct 2019)

• PDF: https://media.defense.gov/2019/Oct/30/2002203425/-1/-1/0/HARDENING%20SIEM%20SOLUTIONS_20191008-NSAGOV.PDF

#NSA GitHub (github.com/nsacyber)

• Publications index: https://nsacyber.github.io/publications.html
• Open source tools: https://nsacyber.github.io/opensource.html
• Mitigating-Obsolete-TLS: detection tools and configs
• Hardware-and-Firmware-Security-Guidance: Spectre/Meltdown, Secure Boot
• Unfetter: ATT&CK framework-based defensive gap identification
• Certificate-Authority-Situational-Awareness: rogue CA detection