NSA Cybersecurity Advisories & Guidance


NSA leverages its elite technical capability to develop advisories and mitigations on evolving cybersecurity threats.

Browse or search our repository of advisories, info sheets, tech reports, and operational risk notices listed below. Some resources have access requirements.

For a subset of cybersecurity products focused on telework and general network security for end users, view our Telework and Mobile Security Guidance page.

To read our complete series on protecting DoD microelectronics from adversary influence, view our DoD Microelectronics Guidance page.
 

ImageTitlePublication Date
ESF: Identity and Access Management: Developer and Vendor ChallengesESF: Identity and Access Management: Developer and Vendor Challenges10/4/2023
CSI: Procurement and Acceptance Testing Guide for Servers, Laptops, and Desktop ComputersCSI: Procurement and Acceptance Testing Guide for Servers, Laptops, and Desktop Computers9/28/2023
CSA: People's Republic of China-Linked Cyber Actors Hide in Router FirmwareCSA: People's Republic of China-Linked Cyber Actors Hide in Router Firmware9/27/2023
CSI: Contextualizing Deepfake Threats to OrganizationsCSI: Contextualizing Deepfake Threats to Organizations9/12/2023
CSA: Infamous Chisel Malware Analysis ReportCSA: Infamous Chisel Malware Analysis Report8/31/2023
CSI: Quantum-Readiness: Migration to Post-Quantum CryptographyCSI: Quantum-Readiness: Migration to Post-Quantum Cryptography8/21/2023
CSA: 2022 Top Routinely Exploited VulnerabilitiesCSA: 2022 Top Routinely Exploited Vulnerabilities8/3/2023
CTR: Cisco Firepower Hardening GuideCTR: Cisco Firepower Hardening Guide8/2/2023
CSA: Preventing Web Application Access Control AbuseCSA: Preventing Web Application Access Control Abuse7/27/2023
ESF: 5G Network Slicing: Security Considerations for Design, Deployment, and MaintenanceESF: 5G Network Slicing: Security Considerations for Design, Deployment, and Maintenance7/17/2023
CTR: DoD Microelectronics: Field Programmable Gate Array Level of Assurance 3 Best PracticesCTR: DoD Microelectronics: Field Programmable Gate Array Level of Assurance 3 Best Practices6/29/2023
CTR: DoD Microelectronics: Third-Party IP Review Process for Level of Assurance 3CTR: DoD Microelectronics: Third-Party IP Review Process for Level of Assurance 36/29/2023
CSI: Defending Continuous Integration/Continuous Delivery (CI/CD) EnvironmentsCSI: Defending Continuous Integration/Continuous Delivery (CI/CD) Environments6/28/2023
CSI: BlackLotus Mitigation GuideCSI: BlackLotus Mitigation Guide6/22/2023
CSI: Harden Baseboard Management ControllersCSI: Harden Baseboard Management Controllers6/14/2023
Page 5 of 16

Additional Documents

Some guidance is protected and requires use of a DoD Common Access Card (CAC) to access. Visit https://cyber.mil/nsa/cybersecurity-advisories-and-technical-guidance/ to access the following and other protected documents:

  • Avoid Dangers of Wildcard TLS Certificates and the ALPACA Technique (FOUO version)
  • Protecting VSAT Communications
  • Quantum Security of Symmetric Cryptography and Hash Functions: A Review
  • Securing AWS S3
  • Security Considerations for Office 365 Government Customers