| 17.x |
Approved w/Constraints
[6, 11, 12, 13, 14] |
Approved w/Constraints
[6, 11, 12, 13, 14] |
Approved w/Constraints
[6, 11, 12, 13, 14] |
Approved w/Constraints
[6, 11, 12, 13, 14] |
Approved w/Constraints
[6, 11, 12, 13, 14] |
Approved w/Constraints
[6, 11, 12, 13, 14] |
Approved w/Constraints
[6, 11, 12, 13, 14] |
Approved w/Constraints
[6, 11, 12, 13, 14] |
Approved w/Constraints
[6, 11, 12, 13, 14] |
Approved w/Constraints
[6, 11, 12, 13, 14] |
Approved w/Constraints
[6, 11, 12, 13, 14] |
Approved w/Constraints
[6, 11, 12, 13, 14] |
| | | | [1] | If free trialware is utilized, the software must be purchased or removed at the end of the trial period.
File Transfer Protocol is a prohibited standard within VA and must not be used.
Ensure use of a FIPS 140-2 validated cryptographic module to secure VA sensitive data in applications and devices. Database Management Systems (DBMS) used in VA will be encrypted using FIPS 140-2 (or its successor) validated encryption as stated in section SC-28: Protection of information at Rest of the VA Handbook 6500.If FIPS 140-2 at the application level is not possible technically, FIPS 140-2 compliant full disk encryption (FOE) must be implemented on the hard drive where the DBMS resides as stated in the May 5,
2015 memo from the VA Deputy Assistant Secretary for Information Security titled `FIPS 140-2 Validated Full Disk Encryption (FOE) for Data at Rest in Database Management Systems (DBMS)`.
System administrators may wish to reassess whether they want to deploy SSL inspection capabilities with the VA environment. CERT Tapioca can be used to verify that the SSL inspection solution being used is doing its due diligence to minimize the increased risk to the users. At the very least, system administrators could contact the vendors of SSL inspection software to have them confirm the proper configuration options and behaviors.
Addressing the generic concern of scanning, uploading and downloading of files into a browser all security concerns with regards to uploading VA files to the Internet must be evaluated to ensure proper use and behavior are expected. Risks with uploading VA files to the Internet need to be examined.
Literature of VeriSign digital signing of scanned documents for Dynamsoft Web Twain security issues must be monitored before use. This includes monitoring for Common Vulnerabilities and Exposures (CVE), and also blog citations posted by the software developer.
The product must remain patched and operated in accordance with Federal and Department security and privacy policies and guidelines.
In accordance with National Institute of Standards and Technology (NIST) SP 800-53 and SP 800-70, Information Security is an important business process that must be considered in all phases of the acquisition process to ensure data and information technology (IT) systems are adequately protected against risk of loss, misuse, and unauthorized access. In accordance with FISMA, government information or government IT systems require compliance with the agency IT Security Policy. All information technology acquisitions must meet the requirements outlined in the Federal Acquisition Regulation (FAR) Part 39.101 (d) policy ensuring the use of common security configuration checklists in the management of risk. | | | [2] | Users should check with their supervisor, Information Security Office (ISO) or local OIT representative for permission to download and use this software. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Freeware may only be downloaded directly from the primary site that the creator of the software has advertised for public download and user or development community engagement. Users should note, any attempt by the installation process to install any additional, unrelated software is not approved and the user should take the proper steps to decline those installations. | | | [3] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | | [4] | If free trialware is utilized, the software must be purchased or removed at the end of the trial period.
File Transfer Protocol is a prohibited standard within VA and must not be used.
Ensure use of a FIPS 140-2 validated cryptographic module to secure VA sensitive data in applications and devices. Database Management Systems (DBMS) used in VA will be encrypted using FIPS 140-2 (or its successor) validated encryption as stated in section SC-28: Protection of information at Rest of the VA Handbook 6500.If FIPS 140-2 at the application level is not possible technically, FIPS 140-2 compliant full disk encryption (FOE) must be implemented on the hard drive where the DBMS resides as stated in the May 5, 2015 memo from the VA Deputy Assistant Secretary for Information Security titled `FIPS 140-2 Validated Full Disk Encryption (FOE) for Data at Rest in Database Management Systems (DBMS)`.
System administrators may wish to reassess whether they want to deploy SSL inspection capabilities with the VA environment. CERT Tapioca can be used to verify that the SSL inspection solution being used is doing its due diligence to minimize the increased risk to the users. At the very least, system administrators could contact the vendors of SSL inspection software to have them confirm the proper configuration options and behaviors.
Addressing the generic concern of scanning, uploading and downloading of files into a browser all security concerns with regards to uploading VA files to the Internet must be evaluated to ensure proper use and behavior are expected. Risks with uploading VA files to the Internet need to be examined.
Literature of VeriSign digital signing of scanned documents for Dynamsoft Web Twain security issues must be monitored before use. This includes monitoring for Common Vulnerabilities and Exposures (CVE), and also blog citations posted by the software developer. The product must remain patched and operated in accordance with Federal and Department security and privacy policies and guidelines.
In accordance with National Institute of Standards and Technology (NIST) SP 800-53 and SP 800-70, Information Security is an important business process that must be considered in all phases of the acquisition process to ensure data and information technology (IT) systems are adequately protected against risk of loss, misuse, and unauthorized access. In accordance with FISMA, government information or government IT systems require compliance with the agency IT Security Policy. All information technology acquisitions must meet the requirements outlined in the Federal Acquisition Regulation (FAR) Part 39.101 (d) policy ensuring the use of common security configuration checklists in the management of risk. | | | [5] | If free trialware is utilized, the software must be purchased or removed at the end of the trial period.
File Transfer Protocol is a prohibited standard within VA and must not be used.
Per the Initial Product Review, users must abide by the following constraints:
- Ensure use of a FIPS 140-2 validated cryptographic module to secure VA sensitive data in applications and devices. If it is not technically possible to employ FIPS 140-2 encryption, then other third-party encryption solutions must be used.
- A data loss prevention (DLP) strategy should be employed to insure no Protected Health Information (PHI) / Personally Identifiable Information (PII) is disclosed. VA must enforce a usage policy to supplement DWT`s security controls until an acceptable DLP solution is deployed.
- Usage of DWT should be limited by role-based access controls ensuring the security of the VA network infrastructure and administrators must agree on scanning rules, such as: assets users are allowed to scan, the schedule, and frequency of scans.
| | | [6] | Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities. | | | [7] | If free trialware is utilized, the software must be purchased or removed at the end of the trial period.
Users must ensure that Microsoft Internet Explorer (IE), Firefox, Google Chrome, and Safari are implemented with VA-approved baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
File Transfer Protocol is a prohibited standard within VA and must not be used.
Per the Initial Product Review, users must abide by the following constraints:
- Ensure use of a FIPS 140-2 validated cryptographic module to secure VA sensitive data in applications and devices. If it is not technically possible to employ FIPS 140-2 encryption, then other third-party encryption solutions must be used.
- A data loss prevention (DLP) strategy should be employed to insure no Protected Health Information (PHI) / Personally Identifiable Information (PII) is disclosed. VA must enforce a usage policy to supplement DWT`s security controls until an acceptable DLP solution is deployed.
- Usage of DWT should be limited by role-based access controls ensuring the security of the VA network infrastructure and administrators must agree on scanning rules, such as: assets users are allowed to scan, the schedule, and frequency of scans.
| | | [8] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | | [9] | If free trialware is utilized, the software must be purchased or removed at the end of the trial period.
Users must ensure that Firefox and Google Chrome are implemented with VA-approved baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Users must Divest the use of Internet Explorer with this technology. Other approved internet browsers are available. See Category Tab for details.
File Transfer Protocol is a prohibited standard within VA and must not be used.
Per the Initial Product Review, users must abide by the following constraints:
- Ensure use of a FIPS 140-2 validated cryptographic module to secure VA sensitive data in applications and devices. If it is not technically possible to employ FIPS 140-2 encryption, then other third-party encryption solutions must be used.
- A data loss prevention (DLP) strategy should be employed to insure no Protected Health Information (PHI) / Personally Identifiable Information (PII) is disclosed. VA must enforce a usage policy to supplement DWT`s security controls until an acceptable DLP solution is deployed.
- Usage of DWT should be limited by role-based access controls ensuring the security of the VA network infrastructure and administrators must agree on scanning rules, such as: assets users are allowed to scan, the schedule, and frequency of scans.
| | | [10] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with VA Handbook 6500. | | | [11] | Users should check with their supervisor, Information System Security Officer (ISSO) or local OIT representative for permission to download and use this software. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Freeware may only be downloaded directly from the primary site that the creator of the software has advertised for public download and user or development community engagement. Users should note, any attempt by the installation process to install any additional, unrelated software is not approved and the user should take the proper steps to decline those installations. | | | [12] | This technology can potentially use Bitmap, which is divested in the TRM.
If free trialware is utilized, the software must be purchased or removed at the end of the trial period.
Users must ensure that Firefox, Google Chrome, and Microsoft Edge are implemented with VA-approved baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Users must utilize approved internet browsers, as Microsoft Internet Explorer has reached End of Life status. See Category Tab for details.
The File Transfer Protocol (FTP) features of this software must not be used as the FTP protocol is prohibited for use on the VA network. (For further information see: VA Policy Memo VAIQ 7615193 on Prohibited Use of File Transfer Protocol (FTP) and Telnet Services)
Per the Initial Product Review, users must abide by the following constraints:
- Applications utilizing cryptography are required to use approved NIST FIPS
140-2 or 140-3 certified cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
- A data loss prevention (DLP) strategy should be employed to insure no Protected Health Information (PHI) / Personally Identifiable Information (PII) is disclosed. VA must enforce a usage policy to supplement DWT’s security controls until an acceptable DLP solution is deployed.
- Usage of DWT should be limited by role-based access controls ensuring the security of the VA network infrastructure and administrators must agree on scanning rules, such as: assets users are allowed to scan, the schedule, and frequency of scans.
| | | [13] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. | | | [14] | The Federal Information Processing standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology will require a 3rd party FIPS 140-2 or 140-3 certified solution for any data containing PHI/PII or VA sensitive information, where applicable. More information regarding the Cryptographic Module Validation Program (CMVP) can be found on the NIST website. |
|
