|
<Past |
Future> |
| 16.5.x |
DIVEST
[2, 4, 9, 10, 11, 12] |
DIVEST
[2, 4, 10, 11, 12, 13, 14] |
DIVEST
[2, 4, 10, 11, 12, 13, 14] |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Authorized w/ Constraints (POA&M) |
Unapproved |
Unapproved |
Unapproved |
| 17.10.x |
Approved w/Constraints
[2, 4, 9, 10, 11, 12] |
DIVEST
[2, 4, 10, 11, 12, 13, 14] |
DIVEST
[2, 4, 10, 11, 12, 13, 14] |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Authorized w/ Constraints (POA&M) |
Unapproved |
Unapproved |
Unapproved |
| 17.12.x |
Unapproved |
Approved w/Constraints
[2, 4, 10, 11, 12, 13, 14] |
Approved w/Constraints
[2, 4, 10, 11, 12, 13, 14] |
Approved w/Constraints
[2, 4, 10, 12, 13, 14, 15] |
Approved w/Constraints
[2, 4, 12, 13, 14, 15, 16] |
Approved w/Constraints
[2, 4, 12, 13, 14, 15, 16] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
Authorized w/ Constraints (DIVEST)
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
| 20.9.x |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
Authorized w/ Constraints (DIVEST)
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
| 21.4.x |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
Authorized w/ Constraints (DIVEST)
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
| 21.10.x |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
Authorized w/ Constraints (DIVEST)
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
| 22.3.x |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
Authorized w/ Constraints (DIVEST)
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
| 22.9.x |
Unapproved |
Approved w/Constraints
[2, 4, 10, 11, 12, 13, 14] |
Approved w/Constraints
[2, 4, 10, 11, 12, 13, 14] |
Approved w/Constraints
[2, 4, 10, 12, 13, 14, 15] |
Approved w/Constraints
[2, 4, 12, 13, 14, 15, 16] |
Approved w/Constraints
[2, 4, 12, 13, 14, 15, 16] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
Authorized w/ Constraints (DIVEST)
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
| 23.11.x |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
Authorized w/ Constraints (DIVEST)
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
DIVEST
[2, 4, 12, 14, 15, 16, 17] |
| 24.4.x |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Unapproved |
Approved w/Constraints
[2, 4, 12, 14, 15, 16, 17] |
Approved w/Constraints
[2, 4, 12, 14, 15, 16, 17] |
Authorized w/ Constraints
[2, 4, 12, 14, 15, 16, 17] |
Approved w/Constraints
[2, 4, 12, 14, 15, 16, 17] |
Approved w/Constraints
[2, 4, 12, 14, 15, 16, 17] |
Approved w/Constraints
[2, 4, 12, 14, 15, 16, 17] |
| | | | [1] | Users must ensure that Google Chrome, Microsoft .NET Framework, and Microsoft Internet Explorer (IE) are implemented with VA-authorized baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
If free trialware is utilized, the software must be purchased or removed at the end of the trial period.
Per the Initial Product Review, users must abide by the following constraints:
- System owners should employ the use of FIPS 140-2 compliant software to protect VA sensitive data containing PII/PHI where applicable.
- At the end of the free trial, the product should be removed, or a full software license purchased to mitigate unwanted application and threat vector on the VA network.
- The product will need to be tested in a controlled environment and not process any live data.
- System owners may need to add an exemption to the underlying security software.
- Two solutions can be implemented along with role-based access control:
- a. The automation is assigned a PIV card. This treats the bot as a human worker. Care must be taken so that only specific individuals have access to the PIV card and only when the bot will be invoked.
- b. An alternative method is to assign only one individual the ability to invoke the robot (which shares its owner’s credentials). The process owner or project manager should engage with appropriate security personnel to assure both PII controls and necessary system access controls are designed into each bot.
After installing Nintex RPA Central and Nintex RPA, one must install the Nintex RPA Chrome Extension if you want to target and automate interacting with elements in Google Chrome or Microsoft Edge (Chromium based) web pages. The Nintex RPA Chrome Extension can be installed on Google Chrome and Microsoft Edge. | | | [2] | Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities. | | | [3] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | | [4] | Browser plug-ins and extensions may only be installed by VA IT Operations (ITOPS) and must be used with official VA browser installation packages that are managed by ITOPS. For installation, contact the National Service Desk [Mail Group: National Service Desk - Austin]. Browser extensions must be kept up to date with security patches and enhancements. | | | [5] | Users should check with their supervisor, Information Security Office (ISO) or local OIT representative for permission to download and use this software. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Freeware may only be downloaded directly from the primary site that the creator of the software has advertised for public download and user or development community engagement. Users should note, any attempt by the installation process to install any additional, unrelated software is not authorized and the user should take the proper steps to decline those installations. | | | [6] | Per the May 5th, 2015 memorandum from the VA Chief Information Security Officer (CISO) FIPS 140-2 Validate Full Disk Encryption (FOE) for Data at Rest in Database Management Systems (DBMS) and in accordance with Federal requirements and VA policy, database management must use Federal Information Processing Standards (FIPS) 140-2 compliant encryption to protect the confidentiality and integrity of VA information at rest at the application level. If FIPS 140-2 encryption at the application level is not technically possible, FIPS 140-2 compliant full disk encryption (FOE) must be implemented on the hard drive where the DBMS resides. Appropriate access enforcement and physical security control must also be implemented. All instances of deployment using this technology should be reviewed to ensure compliance with VA Handbook 6500 and National Institute of Standards and Technology (NIST) standards. It is the responsibility of the system owner to work with the local CIO (or designee) and Information Security Officer (ISO) to ensure that a compliant DBMS technology is selected and that if needed, mitigating controls are in place and documented in a System Security Plan (SSP). | | | [7] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | | [8] | Per the May 5th, 2015 memorandum from the VA Chief Information Security Officer (CISO) FIPS 140-2 Validate Full Disk Encryption (FOE) for Data at Rest in Database Management Systems (DBMS) and in accordance with Federal requirements and VA policy, database management must use Federal Information Processing Standards (FIPS) 140-2 compliant encryption to protect the confidentiality and integrity of VA information at rest at the application level. If FIPS 140-2 encryption at the application level is not technically possible, FIPS 140-2 compliant full disk encryption (FOE) must be implemented on the hard drive where the DBMS resides. Appropriate access enforcement and physical security control must also be implemented. All instances of deployment using this technology should be reviewed to ensure compliance with VA Handbook 6500 and National Institute of Standards and Technology (NIST) standards. It is the responsibility of the system owner to work with the local CIO (or designee) and Information Security Officer (ISO) to ensure that a compliant DBMS technology is selected and that if needed, mitigating controls are in place and documented in a System Security Plan (SSP). | | | [9] | Users must ensure that Google Chrome, Microsoft .NET Framework, and Microsoft Internet Explorer (IE) are implemented with VA-authorized baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Microsoft Internet Explorer, a dependency of this technology, is in End-of-Life status and must no longer be used.
If free trialware is utilized, the software must be purchased or removed at the end of the trial period.
Per the Security Assessment Review, users must abide by the following constraints:
Security Engineering (SE) conducted a pre-assessment and security requirements verification of the Nintex RPA Chrome Extension. It is advised that if this product is used within the VA the following constraints be applied:
The Nintex RPA Chrome Extension uses permissions that may not be necessary for the extension to function. Three high and two medium risk permissions were noted. It is advised that permissions are verified with the developer and removed if they are not absolutely necessary for the extension to function. Using permissions that are not essential to the extension’s functionality expose the system, using the Nintex RPA Chrome Extension, to potential vulnerabilities and addition risk that could otherwise be avoided by disabling nonessential permissions.
VA Solution Delivery, Desktop and Device Engineering manages the Google Chrome standard configuration. The standard is based on the Google Chrome DISA STIG, which requires all extensions to be blocked by default. For browser plugins/extensions to be included in the national standard configuration, a request and a business justification must be submitted to Desktop and Device Engineering at the following URL: https://dvagov.sharepoint.com/sites/oitdde/SitePages/Requests.aspx
All browser extensions must be evaluated to determine how each will affect the browser with all the other authorized extensions as well as performance of the browser. | | | [10] | Per the May 5th, 2015 memorandum from the VA Chief Information Security Officer (CISO) FIPS 140-2 Validate Full Disk Encryption (FOE) for Data at Rest in Database Management Systems (DBMS) and in accordance with Federal requirements and VA policy, database management must use Federal Information Processing Standards (FIPS) 140-2 compliant encryption to protect the confidentiality and integrity of VA information at rest at the application level. If FIPS 140-2 encryption at the application level is not technically possible, FIPS 140-2 compliant full disk encryption (FOE) must be implemented on the hard drive where the DBMS resides. Appropriate access enforcement and physical security control must also be implemented. All instances of deployment using this technology should be reviewed to ensure compliance with VA Handbook 6500 and National Institute of Standards and Technology (NIST) standards. It is the responsibility of the system owner to work with the local CIO (or designee) and Information System Security Officer (ISSO) to ensure that a compliant DBMS technology is selected and that if needed, mitigating controls are in place and documented in a System Security Plan (SSP). | | | [11] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with VA Handbook 6500. | | | [12] | Users should check with their supervisor, Information System Security Officer (ISSO) or local OIT representative for permission to download and use this software. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Freeware may only be downloaded directly from the primary site that the creator of the software has advertised for public download and user or development community engagement. Users should note, any attempt by the installation process to install any additional, unrelated software is not authorized and the user should take the proper steps to decline those installations. | | | [13] | Microsoft Internet Explorer, a dependency of this technology, is in End-of-Life status and must no longer be used.
If free trialware is utilized, the software must be purchased or removed at the end of the trial period.
Per the Security Assessment Review, users must abide by the following constraints:
Security Engineering (SE) conducted a pre-assessment and security requirements verification of the Nintex RPA Chrome Extension. It is advised that if this product is used within the VA the following constraints be applied:
The Nintex RPA Chrome Extension uses permissions that may not be necessary for the extension to function. Three high and two medium risk permissions were noted. It is advised that permissions are verified with the developer and removed if they are not absolutely necessary for the extension to function. Using permissions that are not essential to the extension’s functionality expose the system, using the Nintex RPA Chrome Extension, to potential vulnerabilities and addition risk that could otherwise be avoided by disabling nonessential permissions.
VA Solution Delivery, Desktop and Device Engineering manages the Google Chrome standard configuration. The standard is based on the Google Chrome DISA STIG, which requires all extensions to be blocked by default. For browser plugins/extensions to be included in the national standard configuration, a request and a business justification must be submitted to Desktop and Device Engineering at the following URL: https://dvagov.sharepoint.com/sites/oitdde/SitePages/Requests.aspx
All browser extensions must be evaluated to determine how each will affect the browser with all the other authorized extensions as well as performance of the browser. | | | [14] | The Federal Information Processing standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology will require a 3rd party FIPS 140-2 or 140-3 certified solution for any data containing PHI/PII or VA sensitive information, where applicable. More information regarding the Cryptographic Module Validation Program (CMVP) can be found on the NIST website. | | | [15] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. | | | [16] | Per the May 5th, 2015 memorandum from the VA Chief Information Security Officer (CISO) FIPS 140-2 FIPS 140-2 Validate Full Disk Encryption (FOE) for Data at Rest in Database Management Systems (DBMS) and in accordance with Federal requirements and VA policy, database management must use Federal Information Processing Standards (FIPS) 140-2 or its successor to protect the confidentiality and integrity of VA information at rest at the application level. If FIPS 140-2 encryption at the application level is not technically possible, FIPS 140-2 or 140-3 compliant full disk encryption (FOE) must be implemented on the storage device where the DBMS resides. Appropriate access enforcement and physical security control must also be implemented. All instances of deployment using this technology should be reviewed to ensure compliance with VA Handbook 6500 and National Institute of Standards and Technology (NIST) standards. It is the responsibility of the system owner to work with the local CIO (or designee) and Information System Security Officer (ISSO) to ensure that a compliant DBMS technology is selected and that if needed, mitigating controls are in place and documented in a System Security Plan (SSP). By September 22, 2026, all FIPS 140-2 certificate validations will be placed on the Historical List, please refer to FIPS Transition Effort for further guidance and timeline of changes. | | | [17] | Users must ensure that Google Chrome and Microsoft Edge are implemented with VA-authorized baselines. (Refer to the ‘Category’ tab under ‘Runtime Dependencies’)
If free trialware is utilized, the software must be purchased or removed at the end of the trial period.
Per the Security Assessment Review, users must abide by the following constraints:
- Nintex Robotic Process Automation (RPA) is not Federal Information
Processing standards (FIPS) 140-2 (or its successor) certified and will require a
3rd party FIPS 140-2 (or its successor) certified solution for any data
containing PHI/PII or VA sensitive information.
- The vendor offers a free trial that expires after 30 days. At the end of the free
trial, the product should be removed, or a full software license purchased to
mitigate unwanted application and threat vector on the VA network.
- There is a possibility that users of the product may use live data during the
free trial. It is against VA policy to process live data on a non-authorized
software. The product will need to be tested in a controlled environment and
not process any live data.
- The use of ‘bots’ might trigger it as malware by the underlying antivirus or
HIPS software. System owners may need to add an exemption to the
underlying security software.
- Nintex RPA have versions that uses cloud called Nintex Automation Cloud and
Cloud for Government. Users will have to submit a SaaS inquiry form on the
link below to confirm the use case and get procurement approval:
Digital VA Product Marketplace.
- The product now has the capability to utilize native Artificial Intelligence (AI).
The use of AI is increasing, and guidance is still developing. Users must check
the most recent VA guidance before using AI technologies and solutions.
Consideration should be given to the source of any initial data for the AI tool,
if any VA data will be collected and ingested into the data set, where that data
will be stored, and what rights the VA has to that data. “No web-based,
publicly available generative AI service has been authorized for use with VA sensitive data. Examples of these include OpenAI’s ChatGPT and GPT4,
Google’s Bard, Anthropic’s Claude, and Microsoft’s new Bing. VA follows
existing federal requirements and processes to ensure VA data is protected.
When users enter information into an unapproved web-based tool, VA loses
control of the data.
- RPA software bots have the potential to deal with significant amounts of
confidential data. Software bots process information from various databases
within the organization, log into different accounts using supplied passwords,
and gain access to all kinds of information about an organization’s operations,
processes, and employees. Two solutions can be implemented along with
role-based access control:
a. The automation is assigned a PIV card. This treats the bot as a human
worker. Care must be taken so that only specific individuals have access to
the PIV card and only when the bot will be invoked.
b. An alternative method is to assign only one individual the ability to invoke
the robot (which shares its owner’s credentials). The process owner or
project manager should engage with appropriate security personnel to
assure both PII controls and necessary system access controls are assigned
into each bot.
- The Nintex RPA uses permissions that may not be necessary for the extension
to function. Eight risk permissions for Chrome were noted. It is advised that
permissions are verified with the developer and removed if they are not
necessary for the extension to function. Using permissions that are not
essential to the extension’s functionality expose the system, using the Nintex
RPA, to potential vulnerabilities and additional risks that could otherwise be
avoided by disabling nonessential permissions.
Eight findings regarding Chrome permissions from CRXcavator were found:
• High:
1. tabs - Gives your extension access to privileged fields of the Tab
objects used by several Application Programming Interfaces (APIs)
including chrome.tabs and chrome.windows. In many circumstances
your extension will not need to declare the `tabs` permission to
make use of these APIs.
2. pageCapture - Gives your extension access to the
chrome.pageCapture API.
• Medium:
1. nativeMessaging - Gives your extension access to the native
messaging API.
2. webNavigation - Gives your extension access to the
chrome.webNavigation API.
3. storage - Gives your extension access to the chrome.storage API.
4. downloads - Gives your extension access to the chrome.downloads
API.
• Low:
1. background - Makes Chrome start up early and shut down late, so
that apps and extensions can have a longer life. When any installed
hosted app, packaged app, or extension has `background`
permission, Chrome runs (invisibly) as soon as the user logs into
their computer—before the user launches Chrome. The
`background` permission also makes Chrome continue running
(even after its last window is closed) until the user explicitly quits
Chrome. You typically use the `background` permission with a
background page, event page or (for hosted apps) a background
window.
2. activeTab - Requests that the extension be granted permissions
according to the activeTab specification
VA Solution Delivery, Desktop and Device Engineering manages the Chorme
standard configuration. The standard is based on the Chrome DISA STIG, which
requires all extensions to be blocked by default. For browser plugins/extensions
to be included in the national standard configuration, a request and a business
justification must be submitted to Desktop and Device Engineering at the
following URL:
https://dvagov.sharepoint.com/sites/oitdde/SitePages/Requests.aspx
All browser extensions must be evaluated to determine how each will affect the
browser with all the other authorized extensions as well as performance of the
browser |
|
| Note: |
At the time of writing, version 24.4.0 is the most current version, released 04/01/2024. |
