| 15.x |
Approved w/Constraints
[1, 2, 9, 10, 11] |
Approved w/Constraints
[1, 2, 9, 10, 11] |
Approved w/Constraints
[1, 2, 9, 10, 11] |
Approved w/Constraints
[1, 2, 9, 10, 11] |
Approved w/Constraints
[1, 2, 9, 10, 11] |
Approved w/Constraints
[1, 2, 9, 10, 11] |
Approved w/Constraints
[1, 2, 9, 10, 11] |
Approved w/Constraints
[1, 2, 9, 10, 11] |
Approved w/Constraints
[1, 2, 9, 10, 11] |
Approved w/Constraints
[1, 2, 9, 10, 11] |
Approved w/Constraints
[1, 2, 9, 10, 11] |
Approved w/Constraints
[1, 2, 9, 10, 11] |
| | | | [1] | Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities. | | | [2] | Browser plug-ins and extensions may only be installed by VA IT Operations (ITOPS) and must be used with official VA browser installation packages that are managed by ITOPS. For installation, contact the National Service Desk [Mail Group: National Service Desk - Austin]. Browser extensions must be kept up to date with security patches and enhancements. | | | [3] | Users should check with their supervisor, Information Security Office (ISO) or local OIT representative for permission to download and use this software. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Freeware may only be downloaded directly from the primary site that the creator of the software has advertised for public download and user or development community engagement. Users should note, any attempt by the installation process to install any additional, unrelated software is not approved and the user should take the proper steps to decline those installations. | | | [4] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | | [5] | Users must ensure that Google Chrome is implemented with VA-approved baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
VA requires Federal Information Processing Standards (FIPS) 140-2 compliant cryptographic modules for encryption of data at rest and in transit. Ensure underlying infrastructure and application access are configured to provide FIPS 140-2 encryption for web access supporting Dragon for Chrome.
The administrator or installer should ensure that Dragon Web for Chrome is obtained from the authentic Chrome webstore with verifiable web certificate. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Users should check with their supervisor, Information Security Office (ISO) or local OI&T representative for permission to download and use this software. | | | [6] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | | [7] | Users must ensure that Google Chrome is implemented with VA-approved baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
This technology cannot be utilized with Google Docs or Google Drive as these technologies are prohibited for use on the VA network.
Per the Initial Product Review, users must abide by the following constraints:
- If VA sensitive information is involved ensure underlying infrastructure and application access are configured to provide FIPS 140-2 encryption for web access supporting Dragon Web Extensions to provide the VA required FIPS 140-2 compliant cryptographic modules for encryption of data at rest and in transit.
- The administrator or installer must ensure that Dragon Web has a verifiable web certificate. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Users should check with their supervisor, Information Security Office (ISO) or local OI&T representative for permission to download and use this software, as the users must have administrative permission to use it on a Web Extension for all browsers. Login credentials are secured and not stored when passing through Dragon Web Extensions. VA Solution Delivery, Desktop and Device Engineering manages the Chrome, standard configuration. The standard is based on the Chrome DISA STIG, which requires all extensions to be blocked by default. For browser plugins/extensions to be included in the national standard configuration, a request and a business justification must be submitted to Desktop and Device Engineering at the following URL: https://vaww.eie.va.gov/SysDesign/CS/dtrequests. If approved and enabled, all VA endpoint browsers will receive the extension. Therefore, all browser extensions must be evaluated to determine how each will affect the browser with all the other approved extensions as well as performance of the browser.
| | | [8] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with VA Handbook 6500. | | | [9] | Users should check with their supervisor, Information System Security Officer (ISSO) or local OIT representative for permission to download and use this software. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Freeware may only be downloaded directly from the primary site that the creator of the software has advertised for public download and user or development community engagement. Users should note, any attempt by the installation process to install any additional, unrelated software is not approved and the user should take the proper steps to decline those installations. | | | [10] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. | | | [11] | Users must ensure that Microsoft Edge and Google Chrome are implemented with VA-approved baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Per the Initial Product Review, users must abide by the following constraints:
- Dragon Web Extensions will require a 3rd party FIPS 140-2 (or its successor) certified solution for any data containing PHI/PII or VA sensitive information.
- The administrator or installer must ensure that Dragon Web has a verifiable web certificate. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Users should check with their supervisor, Information Security Office (ISO) or local OI&T representative
before downloading any software. The product must remain patched and operated in accordance with Federal and Department security and privacy policies and guidelines.
- Users must ensure that they have the most current version of the product as well as all necessary supporting documentation.
|
|
