| 1.x |
Approved w/Constraints
[3, 5, 6, 7] |
Approved w/Constraints
[3, 5, 6, 7] |
Approved w/Constraints
[3, 6, 7, 8, 9] |
Approved w/Constraints
[3, 6, 8, 9, 10] |
Approved w/Constraints
[3, 8, 9, 10, 11] |
Approved w/Constraints
[3, 8, 9, 10, 11] |
Approved w/Constraints
[3, 8, 9, 10, 11] |
Approved w/Constraints
[3, 8, 9, 10, 11] |
Approved w/Constraints
[3, 8, 9, 10, 11] |
Approved w/Constraints
[3, 8, 9, 10, 11] |
Approved w/Constraints
[3, 8, 9, 10, 11] |
Approved w/Constraints
[3, 8, 9, 10, 11] |
| | | | [1] | Per the Initial Product Review, users must abide by the following constraints:
- System administrators must ensure that the underlying infrastructure (Web Server, Operating System (OS), etc.) utilizes a third-party FIPS 140-2 cryptographic module for all systems that use AlinIQ.
- AlinIQ AMS and its other components must adhere to VA Baseline Configuration Standards. In addition, the following security measures will help ensure the data is secured and protected:
- Ensure connections between On-Line Data Base components (e.g., clients, application server, and data store) are encrypted using Transport Layer Security (TLS), rather than Secure Sockets Layer (SSL).
- Employ security authorization controls, least privileges and separation of duties to prevent unauthorized access to VA sensitive data.
- Deploy a VA-approved web application firewall (WAF) and database firewall to add layers of security to the database system.
- Users should have adequate and periodic Security Awareness Training. VA Handbook 6500 states that supervisors should ensure that a single individual does not perform combinations of functions including, but not limited to:
- Data entry and verification of data.
- Data entry and its reconciliation to output.
- Input of transactions that may result in a conflict of interest, fraud, or abuse, such as input of vendor invoices and purchasing and receiving information.
- Data entry and approval functions.
- Ensure that separation of duties between users is in place and employ the “least privilege rule” when granting access so users are given only necessary access rights or permissions to accomplish assigned tasks. Users requiring elevated privileges must follow the Office of Information Technology (OIT) approved processes, employ two-factor authentication (2FA), and leverage VA-approved directory services such as Active Directory (AD) for authentication and authorization.
- If the AlinIQ Always On Service were to be used for external connections, a full Enterprise Security External Change Council (ESECC) review is required in accordance VA Directive 6004, VA Directive 6517, and VA Directive 6513. The Enterprise Secure External Connection Council (ESECC) must approve and coordinate connection to the specified IP Addresses. System administrators need to work closely with system owners and the VA CSOC to ensure the connection does not have an adverse effect on VA systems and network availability. In addition, monitoring rules should be established and tested to prevent disruption to the VA Network.
| | | [2] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | | [3] | Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities. | | | [4] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | | [5] | Users must ensure that VMware vSphere is implemented with VA-approved baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
This technology must use the latest TRM-approved version of Java Runtime Environment (JRE) - Oracle.
Users must not utilize the Secure Sockets Layer (SSL) protocol, as it is unapproved for use on the TRM.
Users must not utilize Hyper-V Server, as it is at the time of writing, unapproved in the TRM.
Per the Initial Product Review, users must abide by the following constraints:
- System administrators must ensure that the underlying infrastructure (Web Server, Operating System (OS), etc.) utilizes a third-party FIPS 140-2 certified cryptographic module for all systems that use AlinIQ where applicable.
- AlinIQ AMS and its other components must adhere to VA Baseline Configuration Standards. In addition, the following security measures will help ensure the data is secured and protected:
- Ensure connections between On-Line Data Base components (e.g., clients, application server, and data store) are encrypted using Transport Layer Security (TLS), rather than Secure Sockets Layer (SSL).
- Employ security authorization controls, least privileges and separation of duties to prevent unauthorized access to VA sensitive data.
- Deploy a VA-approved web application firewall (WAF) and database firewall to add layers of security to the database system.
- Ensure that separation of duties between users is in place and employ the “least privilege rule” when granting access so users are given only necessary access rights or permissions to accomplish assigned tasks. Users requiring elevated privileges must follow the Office of Information Technology (OIT) approved processes, employ two-factor authentication (2FA), and leverage VA approved directory services such as Active Directory (AD) for authentication and authorization.
- If the AlinIQ Always On Service were to be used for external connections, a full Enterprise Security External Change Council (ESECC) review is required in accordance VA Directive 6004, VA Directive 6517, and VA Directive 6513. The Enterprise Secure External Connection Council (ESECC) must approve and coordinate connection to the specified IP Addresses. System administrators need to work closely with system owners and the VA CSOC to ensure the connection does not have an adverse effect on VA systems and network availability. In addition, monitoring rules should be established and tested to prevent disruption to the VA Network.
| | | [6] | Due to potential information security risks for cloud-based technologies, users should coordinate closely with their facility ISSO for guidance and assistance on cloud products. If further guidance is needed contact the Enterprise Cloud Solution Office (ECSO), which is the body responsible for new software development in and migration of existing systems to the VA Enterprise Cloud (VAEC) and ensuring organizational information, Personally Identifiable Information (PII), Protected Health Information (PHI), and VA sensitive data are not compromised within the VAEC. For information about Software as a Service (SaaS) products or to submit a SaaS product request with the VA OIT Product Engineering team, please use their online form.
(Ref: VA Directive 6004, VA Directive 6517, VA Directive 6513 and VA Directive 6102). | | | [7] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with VA Handbook 6500. | | | [8] | Users must ensure that VMware vSphere is implemented with VA-approved baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
This technology must use the latest TRM-approved version of Java Runtime Environment (JRE) - Oracle.
Users must not utilize the Secure Sockets Layer (SSL) protocol, as it is unapproved for use on the TRM.
Users must not utilize Flyway, Hyper-V Server, Redis and BusyBox, as it is at the time of writing, unapproved in the TRM.
Per the Initial Product Review, users must abide by the following constraints:
- System administrators must ensure that the underlying infrastructure (Web Server, Operating System (OS), etc.) utilizes a third-party FIPS 140-2 certified cryptographic module for all systems that use AlinIQ where applicable.
- AlinIQ AMS and its other components must adhere to VA Baseline Configuration Standards. In addition, the following security measures will help ensure the data is secured and protected:
- Ensure connections between On-Line Data Base components (e.g., clients, application server, and data store) are encrypted using Transport Layer Security (TLS), rather than Secure Sockets Layer (SSL).
- Employ security authorization controls, least privileges and separation of duties to prevent unauthorized access to VA sensitive data.
- Deploy a VA-approved web application firewall (WAF) and database firewall to add layers of security to the database system.
- Ensure that separation of duties between users is in place and employ the “least privilege rule” when granting access so users are given only necessary access rights or permissions to accomplish assigned tasks. Users requiring elevated privileges must follow the Office of Information Technology (OIT) approved processes, employ two-factor authentication (2FA), and leverage VA approved directory services such as Active Directory (AD) for authentication and authorization.
- If the AlinIQ Always On Service were to be used for external connections, a full Enterprise Security External Change Council (ESECC) review is required in accordance VA Directive 6004, VA Directive 6517, and VA Directive 6513. The Enterprise Secure External Connection Council (ESECC) must approve and coordinate connection to the specified IP Addresses. System administrators need to work closely with system owners and the VA CSOC to ensure the connection does not have an adverse effect on VA systems and network availability. In addition, monitoring rules should be established and tested to prevent disruption to the VA Network.
| | | [9] | The Federal Information Processing standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology will require a 3rd party FIPS 140-2 or 140-3 certified solution for any data containing PHI/PII or VA sensitive information, where applicable. More information regarding the Cryptographic Module Validation Program (CMVP) can be found on the NIST website. | | | [10] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. | | | [11] | Due to potential information security risks for cloud-based technologies, users should coordinate closely with their facility ISSO for guidance and assistance on cloud products. If further guidance is needed contact the Enterprise Cloud Solution Office (ECSO), which is the body responsible for new software development in and migration of existing systems to the VA Enterprise Cloud (VAEC) and ensuring organizational information, Personally Identifiable Information (PII), Protected Health Information (PHI), and VA sensitive data are not compromised within the VAEC. For information about Software as a Service (SaaS) products or to submit a SaaS product request, visit the Product Marketplace.
(Ref: VA Directive 6004, VA Directive 6517, VA Directive 6513 and VA Directive 6102). |
|
