4.x |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
| | [1] | Users must not utilize Open Java Development Kit (OpenJDK), as it is at the time of writing, unapproved in the TRM.
Users must ensure that Firefox, Google Chrome, and Microsoft Structured Query Language (SQL) Server are implemented with VA-authorized baselines. (Refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Per the Security Assessment Review, users must abide by the following constraints:
- System Administrators need to be aware of the unsupported versions and must ensure approved versions of the software are being used on the VA assets.
- System Administrators must ensure approved versions of Microsoft SQL Server and Visual C++ are being used on the VA assets.
- System Owners/Administrators need to be aware the Windows SmartScreen blocks the installation of the product. Once the file is downloaded, the unblock option must be checked in the file properties to allow installation.
- System Administrators must ensure approved versions of Jason.NET and Java is being used on the VA assets.
- System Administrators shall monitor the .exe file used by the application with a file integrity checker to ensure no unauthorized changes occur.
- Commander Connect will require a 3rd party FIPS 140-2 (or its successor) certified solution for any data containing PHI/PII or VA sensitive information.
- Due to potential information security risks, SaaS/PaaS solutions must complete the (BIOS process where a collaborative effort between
Demand Management (DM), EPMO IA, Digital Transformation Center (DTC), Enterprise Cloud Solutions Office (ECSO), Chief Technology
Officer (CTO), and stakeholders determines the SaaS/PaaS category during the Discovery Phase. All SaaS and Non-AWS or Azure (VAEC)
PaaS assets are routed to EPMO IA for Analysis and ATO with technical oversight, acquisition, production, and sustainment provided by DTC.
- It should be noted as a concern that the software connects to destination IP address that lies outside of US border.
- To mitigate, Exploit Protection mitigations in Windows 10 must be configured for java.exe, javaw.exe, and javaws.exe.
- To mitigate, system administrators shall use the latest version of the product where possible and monitor both the CVE Details and NIST
NVD websites for any new security vulnerabilities. This technology or standard can be used only if a POA&M review is conducted and signed by the Authorizing Official Designated Representative (AODR) as designated by the Authorizing Official (AO) or designee and based upon a recommendation from the POA&M Compliance Enforcement, has been granted to the project team or organization that wishes to use the technology.
- To mitigate, system administrators shall use the latest version of the product where possible and monitor both the CVE Details and NIST NVD websites for any new security vulnerabilities.
- To mitigate, system administrators shall use the latest version of the product where possible and monitor both the CVE Details and NIST
NVD websites for any new security vulnerabilities.
- To mitigate, system administrators shall use the latest version of the product where possible and monitor both the CVE Details and NIST
NVDwebsites for any new security vulnerabilities.
- To mitigate, system administrators shall use the latest version of the product where possible and monitor both the CVE Details and NIST
NVDwebsites for any new security vulnerabilities.
| | [2] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. | | [3] | Due to National Institute of Standards and Technology (NIST) identified security vulnerabilities, extra vigilance should be applied to ensure the versions remain properly patched to mitigate known and future vulnerabilities. The local ISSO (Information System Security Officer) can provide assistance in reviewing the NIST vulnerabilities. | | [4] | The Federal Information Processing standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology will require a 3rd party FIPS 140-2 or 140-3 certified solution for any data containing PHI/PII or VA sensitive information, where applicable. More information regarding the Cryptographic Module Validation Program (CMVP) can be found on the NIST website. |
|