0.22.x |
Approved w/Constraints [7, 8, 9, 10] |
Approved w/Constraints [7, 8, 9, 10] |
Approved w/Constraints [7, 8, 9, 10] |
Approved w/Constraints [7, 9, 10, 11] |
Approved w/Constraints [7, 9, 10, 11] |
Approved w/Constraints [7, 9, 10, 11] |
Approved w/Constraints [7, 9, 10, 11] |
Approved w/Constraints [7, 9, 10, 11] |
Approved w/Constraints [7, 9, 10, 11] |
Approved w/Constraints [7, 9, 10, 11] |
Approved w/Constraints [7, 9, 10, 11] |
Approved w/Constraints [7, 9, 10, 11] |
| | [1] | Users should ensure that they are using the VA-approved version of OpenSSL (v1.0.2o) when utilizing this technology. | | [2] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | [3] | Users should check with their supervisor, Information Security Office (ISO) or local OIT representative for permission to download and use this software. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Freeware may only be downloaded directly from the primary site that the creator of the software has advertised for public download and user or development community engagement. Users should note, any attempt by the installation process to install any additional, unrelated software is not approved and the user should take the proper steps to decline those installations. | | [4] | Due to National Institute of Standards and Technology (NIST) identified security vulnerabilities, extra vigilance should be applied to ensure the versions remain properly patched to mitigate known and future vulnerabilities. The local ISO can provide assistance in reviewing the NIST vulnerabilities. | | [5] | Users should ensure that they are using the VA-approved version of OpenSSL (v1.0.2o) when utilizing this technology.
Per the Initial Product Review, users must abide by the following constraints:
- OpenSC must be run on VA standard desktops as it relies on the underlying
operating system for encryption.
- The VA requires support for all software used on the VA network. Vendor or
third-party support at an enterprise level is not free and must be acquired for
any open source product to be deployed on the VA network. The OpenSC
community has a mailing list as their main form of support. Per community: “But
if you are using OpenSC as part of some other product, for example Red Hat
Enterprise Linux, we as a Red Hat are able to provide commercial support for
OpenSC deployments in RHEL. Similarly if you are using some particular
hardware (ex. Nitrokey), they have engineers who are able to offer commercial
support.”
- System administrators must ensure that the latest stable version of OpenSC is
used. OpenSC must also be included in the list of continuously monitored
software for vulnerabilities, patches, and upgrades.
| | [6] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | [7] | Users must not use OpenVPN with this technology as it is prohibited for use at this time.
Users must not use PuTTY or TrueCrypt with this technology as they are unapproved for use at this time.
Users must ensure that Firefox and Google Chrome are implemented with VA-approved baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Users must utilize approved internet browsers, as Microsoft Internet Explorer has reached End of Life status. See Category Tab for details.
Users must not utilize the Secure Sockets Layer (SSL) protocol, as it is unapproved for use on the TRM.
This technology must use the latest TRM-approved version of Java Development Kit (JDK) - Oracle.
Per the Initial Product Review, users must abide by the following constraints:
- OpenSC must be run on VA standard desktops as it relies on the underlying
operating system for encryption.
- The VA requires support for all software used on the VA network. Vendor or
third-party support at an enterprise level is not free and must be acquired for
any open source product to be deployed on the VA network. The OpenSC
community has a mailing list as their main form of support. Per community: “But
if you are using OpenSC as part of some other product, for example Red Hat
Enterprise Linux, we as a Red Hat are able to provide commercial support for
OpenSC deployments in RHEL. Similarly if you are using some particular
hardware (ex. Nitrokey), they have engineers who are able to offer commercial
support.”
- System administrators must ensure that the latest stable version of OpenSC is
used. OpenSC must also be included in the list of continuously monitored
software for vulnerabilities, patches, and upgrades.
| | [8] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with VA Handbook 6500. | | [9] | Users should check with their supervisor, Information System Security Officer (ISSO) or local OIT representative for permission to download and use this software. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Freeware may only be downloaded directly from the primary site that the creator of the software has advertised for public download and user or development community engagement. Users should note, any attempt by the installation process to install any additional, unrelated software is not approved and the user should take the proper steps to decline those installations. | | [10] | Due to National Institute of Standards and Technology (NIST) identified security vulnerabilities, extra vigilance should be applied to ensure the versions remain properly patched to mitigate known and future vulnerabilities. The local ISSO (Information System Security Officer) can provide assistance in reviewing the NIST vulnerabilities. | | [11] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. |
|