5.x |
Approved w/Constraints [1, 3, 4] |
Approved w/Constraints [1, 3, 4] |
Approved w/Constraints [1, 3, 4] |
Approved w/Constraints [1, 3, 4] |
DIVEST [3, 4, 5, 6] |
DIVEST [3, 4, 5, 6] |
DIVEST [3, 4, 5, 6] |
DIVEST [3, 4, 5, 6] |
DIVEST [3, 5, 6, 7] |
DIVEST [3, 5, 6, 7] |
Unapproved |
Unapproved |
6.8.x |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Approved w/Constraints [3, 4, 5, 6] |
Approved w/Constraints [3, 4, 5, 6] |
Approved w/Constraints [3, 4, 5, 6] |
Approved w/Constraints [3, 4, 5, 6] |
Approved w/Constraints [3, 5, 6, 7] |
Approved w/Constraints [3, 5, 6, 7] |
Approved w/Constraints [3, 5, 6, 7] |
Approved w/Constraints [3, 5, 6, 8] |
| | [1] | Users must ensure that Firefox, Google Chrome, Microsoft Internet Explorer (IE), and Safari are implemented with VA-authorized baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Per the Initial Product Review, users must abide by the following constraints:
- Ensure use of a FIPS 140-2 cryptographic module to secure VA sensitive data in applications and devices that use the Okta Browser plugin.
- The Okta Browser Plugin should only be considered when a VA authorized solution does not meet the necessary requirements, and the use for more specialized tools are warranted.
- Due to potential information security risks, SaaS/Platform as a Service(PaaS) solutions must complete the Veterans-Focused Integration Process Request (VIPR) process where a collaborative effort between Demand Management (DM), Enterprise Program Management Office Information Assurance (EPMO IA), Project Special Forces (PSF), Enterprise Cloud Solutions Office (ECSO), Chief Technology Officer (CTO), and stakeholders determines the SaaS/PaaS category during the Discovery Phase. All SaaS and Non-AWS/Azure (VAEC) PaaS assets are routed to EPMO IA for Analysis and Approval to Operate (ATO) with technical oversight, acquisition, production, and sustainment provided by PSF.
- VA Solution Delivery, Desktop and Device Engineering manages the browsers reviewed (Chrome, Firefox, Internet Explorer and Edge) standard configurations. The standard is based on the applicable DISA STIG, which requires all extensions to be blocked by default. For browser plugins/extensions to be included in the national standard configuration, a request and a business justification must be submitted to Desktop and Device Engineering at the following URL: https://vaww.eie.va.gov/SysDesign/CS/dtrequests. If authorized and enabled, all VA endpoint browsers will receive the extension. Therefore, all browser extensions must be evaluated to determine how each will affect the browser with all the other authorized extensions as well as performance of the browser.
The Okta browser plugin is not Federal Information Processing Standards (FIPS) 140-2 certified. The plugin does utilize Transport Layer Security (TLS) 1.2 for data in transit. Ensure use of a FIPS 140-2 cryptographic module to secure VA sensitive data in applications and devices that use the Okta Browser plugin.
There are other VA-authorized solutions that can be utilized. The Okta Browser Plugin should only be considered when a VA-authorized solution does not meet the necessary requirements, and the use for more specialized tools are warranted.
Okta is a Federal Information Security Management Act (FISMA) Moderate level Federal Risk and Authorization Management Program (FedRAMP) authorized Software as a Service (SaaS) solution; however, due to potential information security risks, SaaS/Platform as a Service(PaaS) solutions must complete the Veterans-Focused Integration Process Request (VIPR) process where a collaborative effort between Demand Management (DM), Enterprise Program Management Office Information Assurance (EPMO IA), Project Special Forces (PSF), Enterprise Cloud Solutions Office (ECSO), Chief Technology Officer (CTO), and stakeholders determines the SaaS/PaaS category during the Discovery Phase. All SaaS and Non-AWS/Azure (VAEC) PaaS assets are routed to EPMO IA for Analysis and Authority to Operate (ATO) with technical oversight, acquisition, production, and sustainment provided by PSF.
The Okta plugin has not been evaluated by Solution Delivery, Desktop and Device Engineering, which manages the browsers reviewed (Chrome, Firefox, Internet Explorer and Edge) standard configurations. The standard is based on the applicable Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG), which requires all extensions to be blocked by default. For browser plugins/extensions to be included in the national standard configuration, a request and a business justification must be submitted to Desktop and Device Engineering at the following URL: https://vaww.eie.va.gov/SysDesign/CS/dtrequests. If authorized and enabled, all VA endpoint browsers will receive the extension. Therefore, all browser extensions must be evaluated to determine how each will affect the browser with all the other authorized extensions as well as performance of the browser. | | [2] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | [3] | Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities. | | [4] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | [5] | Users must ensure that Firefox, Google Chrome, Microsoft Internet Explorer (IE), and Safari are implemented with VA-authorized baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Per the Initial Product Review, users must abide by the following constraints:
- Ensure use of a FIPS 140-2 cryptographic module to secure VA sensitive data in applications and devices that use the Okta Browser plugin.
- The Okta Browser Plugin should only be considered when a VA authorized solution does not meet the necessary requirements, and the use for more specialized tools are warranted.
- Users must Divest the use of Internet Explorer with this technology. Other authorized internet browsers are available. See Category Tab for details.
- Due to potential information security risks, SaaS/Platform as a Service(PaaS) solutions must complete the Veterans-Focused Integration Process Request (VIPR) process where a collaborative effort between Demand Management (DM), Enterprise Program Management Office Information Assurance (EPMO IA), Project Special Forces (PSF), Enterprise Cloud Solutions Office (ECSO), Chief Technology Officer (CTO), and stakeholders determines the SaaS/PaaS category during the Discovery Phase. All SaaS and Non-AWS/Azure (VAEC) PaaS assets are routed to EPMO IA for Analysis and Approval to Operate (ATO) with technical oversight, acquisition, production, and sustainment provided by PSF.
- VA Solution Delivery, Desktop and Device Engineering manages the browsers reviewed (Chrome, Firefox, Internet Explorer and Edge) standard configurations. The standard is based on the applicable DISA STIG, which requires all extensions to be blocked by default. For browser plugins/extensions to be included in the national standard configuration, a request and a business justification must be submitted to Desktop and Device Engineering at the following URL: https://vaww.eie.va.gov/SysDesign/CS/dtrequests. If authorized and enabled, all VA endpoint browsers will receive the extension. Therefore, all browser extensions must be evaluated to determine how each will affect the browser with all the other authorized extensions as well as performance of the browser.
. | | [6] | Browser plug-ins and extensions may only be installed by VA IT Operations (ITOPS) and must be used with official VA browser installation packages that are managed by ITOPS. For installation, contact the National Service Desk [Mail Group: National Service Desk - Austin]. Browser extensions must be kept up to date with security patches and enhancements. | | [7] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with VA Handbook 6500. | | [8] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. |
|