VA Technical Reference Model v 24.11

The following reference(s) are associated with this entry:

Note: This list may not be complete. No component, listed or unlisted, may be used outside of the technology in which it is released. The usage decision for a component is found in the Decision and Decision Constraints.

• Windows Client - Authorized w/ Constraints
• Windows Server - Authorized w/ Constraints

Runtime Dependencies:

• Microsoft .NET Framework - Authorized w/ Constraints

Optional Dependencies:

• No optional dependencies have been identified.

Comparable Technologies:

• Live Campaign - Authorized w/ Constraints
• Spok Secure Messaging - Authorized w/ Constraints

Companion Technologies/Supported Standards:

• Simple Mail Transfer Protocol (SMTP) - Authorized

Adoption Benefits

• This is a mature technology.

• At the time of writing, no National Institute of Standards and Technology (NIST) vulnerabilities had been reported and no VA Network Security Operations Center (NSOC) bulletins had been issued for the latest versions of this technology.

Adoption Risks

• Support may be limited for this technology.

• The product is not Federal Information Processing Standards (FIPS) 140-2 compliant. But per vendors documentation, SMTP FIPS 140-2 validated cryptographic module for encryption is provided below: “SMTP Mail Sender uses the built in .NET library for establishing a secure connection to whatever server it is configured for: The EnableSsl property specifies whether SSL is used to access the specified SMTP mail server. The default value for this property can also be set in a machine or application configuration file. Any changes made to the EnableSsl property override the configuration file settings. The SmtpClient class only supports the SMTP Service Extension for Secure SMTP over Transport Layer Security as defined in RFC 3207. In this mode, the SMTP session begins on an unencrypted channel, and then a STARTTLS command is issued by the client to the server to switch to secure communication using SSL. See RFC 3207 published by the Internet Engineering Task Force (IETF) for more information. An alternate connection method is where an SSL session is established up front before any protocol commands are sent. This connection method is sometimes called SMTP/SSL, SMTP over SSL or SMTPS and by default uses port 465. This alternate connection method using SSL is not currently supported”

• SMTP Mail Sender is not the standard VA enterprise mail solution.  

• SMTP Mail Sender is a freeware/Shareware application.

• SMTP Mail Sender also runs from a USB thumb drive, which allows users to send emails from anywhere there is access to a computer with Internet access, but USB thumb drive devices could be misplaced or stolen. All VA owned mobile devices must be encrypted using FIPS 140-2, Security Requirements for Cryptographic Modules, validated encryption (or its successor) unless encryption is not technically possible, as determined and authorized by my local ISO, CIO and the DAS for OIS. This includes laptops, thumb drives, and other removable storage devices and storage media (e.g., CDs, Digital Video Discs (DVD).

• This technology may collect, store or transmit Personally Identifiable Information (PII) or Protected Health information (PHI) and proper security standards must be followed in these cases.

Architectural Risks

• This technology is not portable as it runs only on Windows platforms.