| 1.x |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
Authorized w/ Constraints [1, 2, 3, 4] |
| | | | [1] | Users must not utilize TeamViewer, as it, at the time of writing, requires a POA&M.
This technology requires using a Universal Service Bus (USB) technology to transfer data into the records. As such, proper precautions need to be taken to protect data.
Per the Security Assessment Review (SAR), users must abide by the following constraints:
- EXStar v1.x default install is pointing to the c:\shining3d\exstar\ directory instead of the c:\program files\ directory. It also creates a Cfg folder on the root of c:\. To mitigate, the administrator shall install EXStar v1.x into the “c:\program files\” directory. Temporary or unnecessary folder(s)/file(s) found off the root of c:\ should be deleted.
- A vulnerability exists because EXStar v1.x installs an outdated (5.12.8.0) version of QT5 with multiple published vulnerabilities. To mitigate, system administrators shall use the TRM authorized version of QT5 where possible and monitor both the CVE Details and NIST National Vulnerability Database websites for any new security vulnerabilities.
- A vulnerability exists because Shining 3D is headquartered in Hangzhou, China. China is not a Trade Agreements Act (TAA) designated country. To mitigate, obtain a written Country of Origin attestation and TAA/BAA status from the reseller/manufacturer.
- A vulnerability exists because EXStar v1.x uses outdated (1.0.2q; 1.1.1d and 1.1.1f) versions of OpenSSL with multiple published vulnerabilities. To mitigate, system administrators shall use the TRM authorized version of OpenSSL where possible and monitor both the CVE Details and NIST National Vulnerability Database websites for any new security vulnerabilities.
- A vulnerability exists because EXStar v1.x includes an unsupported (10.0.40219) version of Microsoft C and C++ Libraries. Microsoft no longer provides maintenance and security support for the product. To mitigate, administrators must ensure that installed versions of Microsoft C Runtime Libraries are updated to a TRM approved version of the software. The vendor must maintain all third-party components during the entire product lifecycle, including responding to vulnerabilities discovered in third-party components
used in the product.
- A vulnerability exists because EXStar v1.x installs an outdated (15.30.3.0) version of TeamViewer. TeamViewer is not authorized for use in VA. To mitigate, TeamViewer must be removed from the machine.
- EXStar v1.x utilizes the Shining 3D Digital Cloud. Shining 3D cloud services are not FedRAMP-authorized. To mitigate, the ISSO shall educate and prohibit users from using the integrated cloud service capability until the VA Cloud Security Requirements have been met and the affected A&A package has been appropriately updated. Use EXStar offline activation and keep all scanning hosts air gapped.
| | | [2] | The Federal Information Processing standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology will require a 3rd party FIPS 140-2 or 140-3 certified solution for any data containing PHI/PII or VA sensitive information, where applicable. More information regarding the Cryptographic Module Validation Program (CMVP) can be found on the NIST website. | | | [3] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. | | | [4] | Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities. |
|