Our industries are experiencing cyber events at an alarming rate. At least one Member per month experiences some sort of cyber event. These events are typically triggered by a phishing email or some sort of vulnerability attack that eventually led to ransomware. In these events, some Members have seen full systems encrypted and loss of data.

At NISC, security is always at the forefront of our minds. We are constantly evaluating our processes and looking for areas in which we can improve.

One area for improvement is the manner in which NISC accesses a Member's infrastructure using SecureLink. This access is necessary for NISC staff to provide the best-in-class service and support you have come to expect from NISC, however the default settings have prompted NISC to reevaluate the way we do business. We are recommending that all Members change default settings to permission-based access, with approval coming from the Member before access to the system is granted.

What is the SecureLink Gatekeeper?

The SecureLink Gatekeeper is the software appliance that controls when NISC employees can connect to SecureLink and access a Member's iVUE on-premise infrastructure. Unless otherwise configured, this is currently in an "always-on" state, meaning NISC employees can initiate on-demand connectivity for support purposes. To initiate a connection, NISC employees must log into NISC's SecureLink portal with multi-factor authentication, access a Member's SecureLink record, and click "connect".

What Does It Mean to Disable the SecureLink Gatekeeper?

In many cases, the best practice for access to your systems is to leave access disabled by default and only enable it when work is needed to be completed in your system. Disabling the SecureLink Gatekeeper means that when an NISC employee logs into SecureLink and pulls up your record, instead of being able to connect on demand, the employee will see an option to "request access". This sends an email to the Member's registered gatekeeper users and allows them to either approve or deny access.

In general, NISC recommends leaving the gatekeeper disabled by default to support a best practice model for access. In some cases, you may still wish to leave the gatekeeper enabled by default such as to support an ongoing implementation or an iVUE application upgrade. You can also set access schedules such as to only allow access during the business day but restrict by default outside traditional business hours.

What is the Risk?

The objective is to minimize the chance that someone could compromise existing SecureLink credentials to initiate an on-demand session to a Member's on-premise infrastructure without going through the checks and balances of requesting access first.

How Do I Disable the SecureLink Gatekeeper?

These are the steps to disabling the SecureLink gatekeeper:

• Identify your organization's Gatekeeper users. These are the individuals who will be responsible for approving access requests. NISC will create accounts for these designated users at your request.
• Register your Gatekeeper user  account. After NISC creates accounts for designated gatekeeper users, you will receive an email to confirm your account, create a password and set up multi-factor authentication
• Log into Your New Account and Manage or Disable Gatekeepers. NISC has additional documentation on how to manage the gatekeepers once you have been set up with an account

When Should I Enable the Gatekeeper?

NISC recommends that you only enable the Gatekeeper if you receive a support request. That support request should include a case number, point of contact and reason for the connection. If you do not feel the request provides satisfactory information, consider declining it and reaching out to NISC support for more information.

If you are going through an implementation project, NISC recommends enabling the Gatekeeper for up to seven days at a time to support continual connections throughout the implementation.

If you have scheduled an application upgrade or monthly security patch, NISC recommends enabling the Gatekeeper for up to two days to support the scheduling of the upgrade, the upgrade deployment, and any post-upgrade activity the support team needs to perform.

We strongly recommend having two or more Gatekeeper users at a site so that someone can be a backup if the primary Gatekeeper user is unavailable.

What are Next Steps?

Our goals at NISC are to ensure we balance productivity and Member satisfaction while leveraging best practices to limit cybersecurity risk. While this shift in permission will require a commitment from your organization, we feel it is the best approach to improve our cybersecurity posture and protect our systems.

To begin using the SecureLink permission-based access options, please reach out to NISC Technical Support.

Thank you for your time – and thank you for assisting us in keeping NISC and the Membership as secure as possible!

Sincerely,

Mike Weber
NISC Vice President of Member Success
mike.weber@nisc.coop

You are receiving this e-mail from NISC because you are a Member or Customer. To ensure that you continue to receive e-mails from us, please add mailing@nisc.coop to your address book today. This e-mail message is for the sole use of the intended recipient (s) and may contain confidential and privileged information. Any unauthorized review, copying, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. Thank you.