3.x |
Approved w/Constraints [1, 2, 3, 4, 5] |
Approved w/Constraints [1, 2, 3, 4, 5] |
Approved w/Constraints [1, 2, 3, 4, 5] |
Approved w/Constraints [1, 2, 4, 5, 6] |
Approved w/Constraints [1, 2, 4, 5, 6] |
Approved w/Constraints [1, 2, 4, 5, 6] |
Approved w/Constraints [1, 2, 4, 5, 6] |
Approved w/Constraints [1, 2, 4, 5, 6] |
Approved w/Constraints [1, 2, 4, 5, 6] |
Approved w/Constraints [1, 2, 4, 5, 6] |
Approved w/Constraints [1, 2, 4, 5, 6] |
Approved w/Constraints [1, 2, 4, 5, 6] |
| | [1] | This technology involves the use Universal Serial Bus (USB) connections and proper security precautions must be taken when used.
The Federal Processing Standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology must not be used to handle any data containing PHI/PII or VA sensitive information, unless FIPS 140-2 encryption can be enabled, or a 3rd party FIPS 140-2 certified solution can be deployed to protect it. | | [2] | This technology has received one or more VA security bulletins that provide specific guidance on vulnerability patching and mitigation. It is the responsibility of VA system owners to ensure that the appropriate mitigations are taken to address all known and future discovered vulnerabilities with this product. See the Reference tab for more information on security bulletins related to this product. | | [3] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with VA Handbook 6500. | | [4] | Due to National Institute of Standards and Technology (NIST) identified security vulnerabilities, extra vigilance should be applied to ensure the versions remain properly patched to mitigate known and future vulnerabilities. The local ISSO (Information System Security Officer) can provide assistance in reviewing the NIST vulnerabilities. | | [5] | If this technology is an FDA certified medical device or is categorized by the Department as a networked medical device then it must be isolated and protected in accordance with The Medical Device Isolation Architecture (MDIA) 2015 Guidance. This guideline stipulates that if the device meets ANY of the following criteria, then it must be isolated:
- If the device cannot have the VA standard desktop security suite loaded on it. This includes but is not limited to Anti-Virus, HIPS, USB Access controls, software/hardware inventory, automated software updates/patches and Group Policy Objects (GPOs)
- If the device is a Windows device and cannot be part of the domain
- If the device is not part of the regular IT patched management process
- Non Windows devices (UNIX, Linux, MAC/Apple, etc.)
The criteria should be applied to both FDA certified and non-FDA certified devices which must maintain medical/clinical functionality. An example would be a PC that is not running the current supported operating system in order to manage medication-dispensing devices. While these may not be considered strictly medical devices, they are still vulnerable to attack and need to be protected. For guidance and assistance in security networked medical devices, please contact the Medical Device Isolation Architecture (MDIA) Working Group. | | [6] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. |
|