11.x |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
| | [1] | Users must ensure that Firefox, Microsoft Edge, and Google Chrome are implemented with VA-approved baselines. (Refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Users must not utilize the Secure Sockets Layer (SSL) protocol, as it requires a POA&M.
Per the Security Assessment Review (SAR), users must abide by the following constraints:
- AIPHONE IX Support Tool will require a 3rd party FIPS 140-2 (or its
successor) certified solution for any data containing Personal Health
Information (PHI) Personal Identification Information (PII) or VA
Sensitive Information.
- To mitigate, an administrator shall monitor the .exe files used by the
application with a file integrity checker to ensure no unauthorized
changes occur.
- To mitigate, the vendor must maintain all third-party/open-source
components incorporated into AIPhone IX Support Tool, during the
entire product lifecycle, including responding to vulnerabilities
discovered in third-party components used in the product.
- To mitigate, the vendor must maintain all third-party/open-source
components incorporated into AIPhone IX Support Tool, during the
entire product lifecycle, including responding to vulnerabilities
discovered in third-party components used in the product.
- To mitigate, an administrator shall ensure strong access control
permissions on data files containing authentication data. Database
files must be encrypted at rest and remain protected in transit and
backups.
- To mitigate, AIPhone IX Support Tool shall be configured to meet
minimum password-based authentication standards per VA
Knowledge Service Control IA-5(1).
| | [2] | Due to National Institute of Standards and Technology (NIST) identified security vulnerabilities, extra vigilance should be applied to ensure the versions remain properly patched to mitigate known and future vulnerabilities. The local ISSO (Information System Security Officer) can provide assistance in reviewing the NIST vulnerabilities. | | [3] | The Federal Information Processing standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology will require a 3rd party FIPS 140-2 or 140-3 certified solution for any data containing PHI/PII or VA sensitive information, where applicable. More information regarding the Cryptographic Module Validation Program (CMVP) can be found on the NIST website. | | [4] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. |
|