36C24419R0074-003.pdf

FY19 Text-Only Course Transcript i

Attachment A

FY19 Text-Only Course Transcript ii

Contents Purpose of this Document .......................................................................................................... v

Using Hyperlinks Within This Document ..................................................................................... v

Topic 1: Course Introduction

1.1 Welcome

1.2 Organizational and Non-Organizational Users

1.3 Who Must Take This Course?

1.4 Why Do You Have to Take This Course?

1.5 Types of VA Sensitive Information

1.6 Rules of Behavior

1.7 What to Expect

Topic 2: Handling VA Information

2.1 Introduction

2.2 Protecting Sensitive Information

2.3 Need-to-Know

2.4 Handling PII With Care

2.5 Safeguarding Paper Documents

2.6 Paper Documents

2.7: Mismailing Sensitive Information

2.8: Records Management

2.9: Keeping Records Safe and Secure

2.10: Summary

Topic 3: Accessing VA Information Systems

3.1 Introduction

3.2 Protecting Access to VA Systems

3.3 Identification and Authentication

3.4 Lost PIV Card

3.5 Minimum Access

3.6 Protecting Systems

3.7 Securing Your VA Workstation

3.8 Data Protection Software

3.9 Connecting to the Network Using a Non-GFE Computer System

3.10 Summary

FY19 Text-Only Course Transcript iii

Topic 4: Protecting VA Computer Resources

4.1 Introduction

4.2 Protecting VA-Issued Devices

4.3 Downloading Software

4.4 Limited Personal Use

4.5 Unauthorized Visitors and Stolen Laptop

4.6 Stolen or Missing Equipment

4.7 Disposing of Old Flash Drives

4.8 Mobile Phone Recertification

4.9 Mobile Phone Reminders

4.10 Summary

Topic 5: Securing Electronic Data

5.1 Introduction

5.2 Securing Sensitive Information

5.3 Social Engineering/Phishing

5.4 Transmitting Sensitive Information

5.5 Using Email Securely

5.6 Email Encryption

5.7 Non-official Email for VA Business

5.8 Using Appropriate Wireless Access for VA Business

5.9 Summary

Topic 6: Working Remotely

6.1 Introduction

6.2 Working Securely from a Remote Location

6.3 Securing VA Information at Your Remote Location

6.4 Safeguarding Sensitive Information at Your Remote Location

6.5 Protecting Informaton and Systems While on Travel

6.6 Accessing Information From Publicly Available Systems

6.7 International Travel

6.8 Summary

Topic 7: Reporting Incidents

7.1 Introduction

7.2 What Is an Incident?

7.3 Steps and Points of Contact

7.4 Recognize and Report an Incident

FY19 Text-Only Course Transcript iv

7.5 Summary

Topic 8: Summary and Rules of Behavior

8.1 Wrap-Up

8.2 Acknowledge, Accept, and Comply With the ROBs

8.3 Completion

Appendix A: Department of Veteran Affairs Information Security Rules of Behavior for Organizational Users .............................................................................................................. A-1 Appendix B: Department of Veteran Affairs Information Security Rules of Behavior for Non- Organizational Users .............................................................................................................. B-1 Appendix C: Glossary ............................................................................................................. C-1

Appendix D: Privacy and Information Security Resources...................................................... D-1

FY19 Text-Only Course Transcript v

Purpose of this Document This text-only course transcript is designed to accommodate users in any of the following circumstances:

• You are using a screen reader, such as JAWS, to complete course material and have difficulty with the interactions in the online version.

• You are experiencing difficulties accessing the online version due to computer network or bandwidth issues.

• You have completed the online version and want to print a copy of the course material for reference.

This version of the VA Privacy and Information Security Awareness and Rules of Behavior Text-Only Course Transcript is valid for fiscal year (FY) 2019 (i.e., October, 2018 through September, 2019).

You should take the online version of this course if possible; however, if you complete the course using this text-only transcript, you must complete the following steps:

1. Print, initial each page, and sign the Information Security Rules of Behavior (ROB) for your particular user type.

NOTE: There are two versions of the ROB, one for organizational users and one for non-organizational users. You must initial each page, and then, sign the Acknowledge and Accept section for the user group that applies to you. Review the definitions of organizational and non-organizational Users on the next page to determine your user group.

2. Contact your supervisor or Contracting Officer Representative (COR) to submit the signed ROB and to coordinate with your local Talent Management System (TMS) Administrator to ensure you receive credit for completion.

Using Hyperlinks Within This Document Throughout this document, you are able to access glossary terms, located in Appendix C, by selecting the available hyperlinks. To return to your place in the main document after selecting a hyperlink to an item in the appendix, select Alt +<left arrow> on your keyboard. Some browsers will not permit the Alt+<left arrow> navigation feature; therefore, it is recommended that you download the PDF to your desktop and then open the PDF in Adobe Acrobat.

FY19 Text-Only Course Transcript 1

Topic 1: Course Introduction

1.1 Welcome

Welcome to the VA Privacy and Information Security Awareness and Rules of Behavior: Everyday Journey to Protect VA training course.

1.2 Organizational and Non-Organizational Users

Most of VA’s employees are organizational users. Organizational users are VA employees, contractors, researchers, students, volunteers, and representatives of federal, state, local, or tribal agencies not representing a Veteran or claimant.

Non-organizational users are any information system user not clearly identified as an organizational user. This includes people with a Veteran or claimant power of attorney.

Each of our journeys are impacted by risks. We need to be aware of these risks and stay vigilant to follow VA’s Rules of Behavior (ROB). This will help us to accomplish our day-to-day duties securely.

When it comes to privacy and information security, all employees are required to follow the ROBs. The ROBs provide guidance for organizational and non-organizational users on how to protect VA sensitive information and safeguard VA systems.

1.3 Who Must Take This Course?

Both organizational and non-organizational users must take this course.

While VA, as an organization, must comply with federal laws dealing with privacy and information security, it all begins with you, the user. Regardless of the role you play at VA, anyone can come in contact with VA sensitive information and information systems. Because of this, everyone has a duty to protect privacy and ensure information security, including you!

As with any rule, there can be exceptions. If you are a Veteran’s Health Administration (VHA) health professions trainee (e.g., student, intern, resident, or fellow), you are not required to complete this course. This requirement is fulfilled by the following:

• First-time trainees complete VHA Mandatory Training for Trainees (VA TMS ID: 3185966).

• Each subsequent year, trainees complete VHA Mandatory Training for Trainees—Refresher

(VA TMS ID: 3192008).

All staff with direct access to Protected Health Information (PHI) or access to PHI through VHA computer systems are required to complete the Privacy and HIPAA Training (VA TMS ID: 10203).

FY19 Text-Only Course Transcript 2

1.4 Why Do You Have to Take This Course?

Like any trip you might take, taking the path to protect VA sensitive information is all about reaching your destination safely. This course will help you become more aware of how to protect VA sensitive information.

All users must take this course prior to using or gaining access to VA information or information systems. To keep your access, you must complete this training annually. Each year, when you complete this training, you will review, acknowledge, and accept the ROBs.

Evolving computer technologies and tools increase the speed and effectiveness of providing services to Veterans. At the same time, new risks are a part of every new opportunity. You must always be aware of these risks and be ready to protect sensitive information and systems. Depending on your role and the information and systems you have access to, you may be required to complete additional role-based security training.

1.5 Types of VA Sensitive Information

Sensitive information can be defined as information that is protected against unauthorized disclosure.

Types of sensitive information include the following:

• Sensitive Personal Information (SPI) – The term, with respect to an individual, means any information about the individual maintained by VA, including the following: (i) education, financial transactions, medical history, and criminal or employment history; (ii) information that can be used to distinguish or trace the individual’s identity, including name, Social Security number, date and place of birth, mother’s maiden name, or biometric records.

• Personally Identifiable Information (PII) – Information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. Examples of PII elements include but are not limited to: name, Social Security number, biometric records, etc., alone, or when combined with other personal or identifying information, which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

• Protected Health Information (PHI) – The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule defines PHI as individually identifiable health information transmitted or maintained in any form or medium by a covered entity, such as VHA.

Note: VHA uses the term PHI to define information that is covered by HIPAA, but unlike individually identifiable health information, may or may not be covered by the Privacy Act of 1974 or Title 38 confidentiality statutes. In addition, PHI excludes employment records held by VHA in its role as an employer.

• Regulatory or program-specific information – Information that VA may not release or may release only in very limited, specific situations. This category of information, which normally would not be released to the public (5 U.S.C. Section 552—the Freedom of Information Act [FOIA]), may include certain, critical information about VA's programs, financial information, law enforcement or investigative information, procurement information, and business proprietary information.

FY19 Text-Only Course Transcript 3

1.6 Rules of Behavior

The VA National ROBs are a set of Department rules that outline the responsibilities and expected behaviors of personnel regarding information system usage.

Most ROBs apply to specific situations like accessing VA computer resources or working remotely, but others are more general.

Be sure to read and follow the rules presented throughout the course that apply to your user type.

Understanding these rules will help you stay on track and take the right action when it comes to complying with the ROBs. The ROBs will be presented for your acknowledgement and acceptance at the end of the course.

Basic ROBs that apply to each user type include the following:

Organizational users:

• I WILL comply with all federal VA information security, privacy, and records management policies.

• I WILL have NO expectation of privacy in any records that I create or in my activities while accessing or using VA information systems.

• I WILL complete mandatory security and privacy awareness training within designated time frames, and complete any additional role-based security training required based on my role and responsibilities.

• I WILL understand that authorized VA personnel may review my conduct or actions concerning VA information and information systems, and take appropriate action.

• I WILL sign specific or unique ROBs as required for access or use of specific VA systems or non-VA systems.

Non-Organizational users:

• I WILL comply with all federal and VA information security, privacy, and records management policies.

• I WILL have NO expectation of privacy in my activities while accessing or using VA information systems, as I understand that all activity is logged for security purposes.

• I WILL complete mandatory security and privacy awareness training within designated time frames.

• I WILL understand that authorized VA personnel may review my conduct or actions concerning VA information and information systems, and take appropriate action.

• I WILL sign specific or unique ROBs as required for access or use of specific VA systems. I may be required to comply with a non-VA entity’s ROB to conduct VA business. While using their system, I must comply with their ROB.

FY19 Text-Only Course Transcript 4

1.7 What to Expect

During this course, you can expect to gain a better understanding of your roles and responsibilities for protecting VA information. To do so, you will take a virtual journey that includes several stops along the way.

At each stop, you will be given important guidance for your everyday journey to protect VA and our Nation’s Veterans. You will also discover how you can assist with records management and, if applicable, complete your mobile phone recertification. Most importantly, you will explore how the ROBs apply to your day-to-day work.

Practical, realistic scenarios are presented throughout this course. You will have the opportunity to reflect on each situation and decide the best action to take to avoid a violation where privacy and security may have been put at risk.

For each scenario, you will receive feedback to help you understand the best action to take as well as the related ROBs that apply to the situation. This will prepare you to acknowledge and accept the ROBs as the last stop of your journey in this course.

FY19 Text-Only Course Transcript 5

Topic 2: Handling VA Information

2.1 Introduction

When you handle sensitive Veteran and VA information, you are operating in a position of trust. Once trust is lost, it can be difficult or even impossible to regain. Be careful to handle that information correctly, regardless of what form it is in.

On this stop in your journey, you will find situations that occur when you are responsible for handling VA information. By following the ROBs and making the right decisions in dealing with VA sensitive information, you are protecting VA, our Veterans, and their families.

When you have completed this topic, you will be able to do the following:

• Recall how to protect VA sensitive information when handling paper documents, records, and files

• Recognize the requirements that everyone must follow for records management

2.2 Protecting Sensitive Information

Sensitive information can be compromised in many ways, including sharing information with people who do not need to know it or through unauthorized disclosure. You are responsible for making decisions when dealing with VA sensitive information, and you need to choose wisely. One wrong turn, and you could end up in a situation where information is at risk.

The scenarios in this section present the basic concepts that each VA employee can implement in his or her day-to-day work to protect VA sensitive information.

2.3 Need-to-Know

Scenario Carlos is a nurse at the VA clinic in his hometown. His Uncle George is a combat Veteran receiving care at that same facility. One afternoon, Carlos’ cousin, Sylvia, calls him to say that she thinks her father has started drinking again. She asks Carlos if he will check George’s medical records to see if her father is being treated for alcoholism. He tells her he is not able to get that information for her.

Did Carlos do the right thing?

Determine the best answer from the options below:

A. Yes. Even though George is Carlos’ family member, Carlos does not have a work-related need to know his uncle’s medical information.

B. No. This situation is a family matter. Because of his cousin’s concern, he should have provided the information.

FY19 Text-Only Course Transcript 6

Correct Feedback The correct answer is A.

Carlos handled this situation correctly. He does not have a need to know what’s in his uncle’s medical record. According to the ROB, he is also not allowed to disclose information relating to the diagnosis or treatment of drug abuse, alcoholism or alcohol abuse, HIV, or sickle cell anemia without appropriate legal authority. He would be accessing the information only for personal reasons, which is a breach of privacy and a violation of HIPAA. Carlos was smart not to let family pressure get to him. He followed the ROB by refusing to get the information for his cousin and avoided a privacy incident.

Rules of Behavior Review the associated rules for your user type below.

Organizational Users:

• I WILL only provide access to sensitive information to those who have a need-to-know for their professional duties, including only posting sensitive information to web-based collaboration tools restricted to those who have a need-to-know and when proper safeguards are in place for sensitive information.

• I WILL NOT disclose information relating to the diagnosis or treatment of drug abuse, alcoholism or alcohol abuse, HIV, or sickle cell anemia without appropriate legal authority. I understand unauthorized disclosure of this information may have a serious adverse effect on agency operations, agency assets, or individuals.

Non-Organizational Users:

• I WILL NOT disclose information relating to the diagnosis or treatment of drug abuse, alcoholism or alcohol abuse, HIV, or sickle cell anemia by VA without appropriate legal authority. Unauthorized disclosure of this information may have a serious adverse effect on agency operations, agency assets, or individuals, and includes criminal penalties.

2.4 Handling PII With Care

Scenario Tamara is a receptionist at her local VA medical center. One morning, she checked out a Veteran who seemed frustrated. She was very busy at the time and wasn’t able to ask if there was anything she could do to help. She thought about it all day and decided to get his file and call him when she got home that evening. She took the Veteran’s file home and called him outside of her working hours to discuss the situation and ended up providing him personal guidance regarding the matter.

Did Tamara handle this situation correctly?

Determine the best answer from the options below:

A. Yes, she was helping a Veteran with his issue.

B. No, Tamara has violated the ROBs that deal with handling PII.

FY19 Text-Only Course Transcript 7

The correct answer is B.

Tamara did not handle this situation correctly. The Veteran may misconstrue Tamara’s personal opinion and perspective as official VA guidance. She used her position to access a certain Veteran’s sensitive information and then took that information off site without authorization or permission. This is a violation of VA policy and may result in HR consequences. Never remove PII information from VA without permission and never use it for unauthorized purposes. Information collected during the performance of duties should only be used for official business purposes. Remember, sensitive information can be as simple as names and phone numbers or as critical as a medical diagnosis or treatment. Ensure confidentiality, and treat all sensitive information as if it were your own.

Rules of Behavior Review the associated rules for your user type below.

Organizational Users:

• I WILL obtain approval from my supervisor to use, process, transport, transmit, download, print or store electronic VA sensitive information remotely (outside of VA owned or managed facilities (e.g., medical centers, community based outpatient clinics (CBOC), or regional offices)).

• I WILL safeguard VA sensitive information, in any format, device, system and/or software in remote locations (e.g., at home and during travel).

2.5 Safeguarding Paper Documents

While it may seem that many documents are electronic, paper documents still exist, and VA has specific best practices for safeguarding them. These documents can include mailings, patient records, files, and other documents that could contain sensitive information.

The scenarios in this section present situations involving the handling of sensitive information, specifically paper documents. It is important to remember that handling such documents appropriately is an essential part of your everyday journey to protect VA.

FY19 Text-Only Course Transcript 8

2.6 Paper Documents

Scenario Steve works at the VA hospital cafeteria. He has been busy cleaning tables from the lunchtime rush. He’s wiping down the last table when he sees a stack of papers and a CD-ROM lying on the table. He picks them up to throw them away but notices that they contain someone’s personal information. There’s a woman’s name, address, phone number, and Social Security number.

How should Steve handle this situation?

Determine the best answer from the options below:

A. Place the items deep down in the trash so no one will see them.

B. Take the items to his supervisor so she can secure the papers and contact an Information System Security Officer (ISSO) or Privacy Officer (PO).

Correct Feedback The correct answer is B.

Taking the items containing personal information to his supervisor is the way to go.

The supervisor can then secure the papers and CD-ROM while contacting the ISSO or PO to report the incident. Had Steve not secured the items, he would have left the personal information exposed for someone else to find. This could have created a data breach. The impact could be disastrous; for example, it could cause identity theft, embarrassment for Veterans, loss of PII/PHI, and distrust of VA.

Rules of Behavior Review the associated rules for your user type below.

Organizational Users

• I WILL ensure that all printed material containing VA sensitive information is physically secured when not in use (e.g., locked cabinet, locked door).

• I WILL NOT make any unauthorized disclosure of any VA sensitive information through any means of communication including, but not limited to, e-mail, instant messaging, online chat, and web bulletin boards or logs.

FY19 Text-Only Course Transcript 9

2.7: Mismailing Sensitive Information

Samir is a VA employee. He needs to mail some documents to a Veteran, Laura. So he looks up Laura’s address in the database, and sends the documents. Later, Samir realizes that he referenced the wrong line for Laura’s address, and the documents were sent to a different Veteran.

Did Samir cause a privacy breach?

Determine the best answer from the options below:

A. No, it was an honest mistake.

B. Yes, he should have been more careful.

Correct Feedback The correct answer is B.

Samir caused a privacy breach. Samir should have confirmed the details of where the documents were being sent to ensure they reached the right person. Now, a different Veteran may have access to Laura’s PII. He will need to call either his supervisor, PO, and/or ISSO to report the incident.

Prevent identity theft. Keep this in mind when using the United States Postal Service or other delivery services.

• Confirm that mailing labels and window envelopes show only the recipient’s name and address and no other information.

• Always verify the person’s name on the envelope matches the person’s name on the documents inside the envelope.

• Ensure that only authorized information is released.

For mass mailings, always spot check to ensure that the correct information is going out in the correct envelope. For additional information on mailing PII, refer to VA Directive 6609, Mailing of Sensitive Personal Information.

Rules of Behavior Review the associated rules for your user type below.

Organizational Users

• I WILL recognize that access to certain databases have the potential to cause great risk to VA, its customers and employees due to the number and/or sensitivity of the records being accessed. I will act accordingly to ensure the confidentiality and security of these data commensurate with this increased potential risk.

• I WILL NOT make any unauthorized disclosure of any VA sensitive information through any means of communication including, but not limited to, e-mail, instant messaging, online chat, and web bulletin boards or logs.

FY19 Text-Only Course Transcript 10

2.8: Records Management Federal records come in many formats. In general, any materials that document the transaction of VA business are potential records.

Be sure you know what could be a record, and reach out to your supervisor or designated records management official if you have questions or if you are creating, transporting, storing, or disposing of materials that may be records.

Everyone must know how to manage records to comply with the Federal Records Act of 1950.

VA has designated records management officials who manage federal records. Federal records must be kept and stored according to the requirements outlined in a records control schedule (RCS).

2.9: Keeping Records Safe and Secure The ROBs that apply to records include the following:

• I WILL comply with all federal VA information security, privacy, and records management policies.

• I WILL have NO expectation of privacy in any records that I create or in my activities while accessing or using VA information systems.

Keep in mind that VA business-related email and text messages may also be considered records.

Exercise caution before deleting them. Reference the memorandum VAIQ 7850460, Proper Use of Email and Other Messaging Services, published January 2, 2018, for more guidance.

To increase your knowledge about how to handle records at VA, you can also locate records management training on the Talent Management System (TMS). Records Management for Everyone (VA TMS ID:4192704) and other recommended courses can be found in the Resources section of this course. They are a great way to hone your skills as you continue your journey to protect VA.

2.10: Summary VA sensitive information comes in many forms and should always be protected.

Follow these best practices when handling VA sensitive information:

• Access information on a need-to-know basis only.

• Avoid unauthorized disclosure of sensitive information.

• Follow the best practices for safeguarding and handling paper documents.

• Verify names and addresses when mailing sensitive information.

• Understand your responsibilities for records management.

FY19 Text-Only Course Transcript 11

Topic 3: Accessing VA Information Systems

3.1 Introduction

VA information systems can be accessed from a variety of locations using a variety of methods.

Knowing how to do so securely is important to maintain the integrity of the system.

On this stop of your journey, you will find scenarios that require responsible access to VA network systems.

When you have completed this topic, you will be able to do the following:

• Recall how to securely access VA systems

• Recall the best action to prevent threats to VA networks and systems

3.2 Protecting Access to VA Systems

VA systems store and process important and sensitive information that is critical for us to provide the best care and service to our Veterans. You must ensure VA systems stay protected to prevent potential compromise of VA sensitive information. Protect your credentials required to access VA systems and make sure you, and others, only have access to the information and systems that are required to do your job.

The scenarios in this section will present you with situations that require you to make the right choice to protect and maintain your accesses to VA information and network systems securely.

3.3 Identification and Authentication

Scenario When you logged in to your VA-issued computer this morning, you came across an issue you’ve never faced before. You asked your coworker, Kathy, to take a look. As you explained what happened, your supervisor called and asked if he could speak to you privately for a moment. Kathy offered to continue to work on the problem while you stepped away to speak with your supervisor. She asked you to leave your Personal Identify Verification (PIV) card/credential and Personal Identification Number (PIN) with her in case she gets locked out.

What should you do next?

Determine the best answer from the options below:

A. Stay logged in with your PIV card and give Kathy the PIN so she can continue to work on the issue while you leave to take the call in a private place.

B. Thank Kathy for the offer but refuse. Lock your computer and remove your PIV card before leaving to take the call.

FY19 Text-Only Course Transcript 12

C. Kindly refuse Kathy’s offer and then lock your computer. It’s okay to leave your PIV card inserted in the computer while you step away for the call since someone would need the PIN to access your account.

Correct Feedback The correct answer is B.

Sharing your account credentials is a violation of the ROBs. Always keep credentials like user names, passwords, and PINs private. Never share your password or other account information, even with trusted coworkers. When leaving your computer workstation, remember to log off and take your PIV card/credential with you. Never leave it in your computer for others to find and compromise. Keep in mind that PIV cards also grant physical access to areas that not all employees have access to. This is another reason to keep your card with you. One of the biggest threats to any organization’s data and information networks is the people who have the easiest access: insiders. Sharing your credentials and access to your VA information system presents an opportunity for an insider threat. Some other best practices to protect your account accesses are to create strong passwords that meet VA minimum requirements and store your VA passwords, if needed, only in files that have the latest validated encryption and that only you can decrypt.

Rules of Behavior Review the associated rules for your user type below.

Non-Organizational Users

• I WILL NOT divulge a personal username, password, access code, verify code, or other access credential to anyone.

• I WILL NOT store my VA passwords or verify codes in any file on any IT system, unless that file has been encrypted using FIPS 140-2 (or its successor) validated encryption, and I am the only person who can decrypt the file.

Organizational and Non-Organizational Users

• I WILL use passwords that meet the VA minimum requirements. Protect my passwords; verify codes, tokens, and credentials from unauthorized use and disclosure.

FY19 Text-Only Course Transcript 13

3.4 Lost PIV Card

Josh is a benefits advisor for the Veterans Benefits Administration (VBA).

It’s Friday, and Josh is looking forward to the weekend. After a very busy day of taking care of Veteran claims and attending meetings, his workday has finally come to an end and he goes to his car to drive home. When he gets to his car, he realizes that his PIV card is no longer on his lanyard.

What should Josh do next?

Determine the best answer from the options below:

A. On his way home, he should contact a coworker to coordinate access to the building on Monday.

B. He should send out a group email to his coworkers to ask if anyone found his PIV card.

C. He should report the card loss to the PIV card issuing facility personnel, VA police, and his ISSO within four hours.

Correct Feedback The correct answer C.

Josh should do the right thing and report the loss of his card. By doing so, Josh will prevent any potential unauthorized use. According to VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, PIV cardholders must notify the PIV card issuing facility personnel, VA police, and their ISSO within four hours of the loss.

Rules of Behavior Review the associated rule for your user type below.

Organizational and Non-Organizational Users

• I WILL protect my passwords; verify codes, tokens, and credentials from unauthorized use and disclosure.

FY19 Text-Only Course Transcript 14

3.5 Minimum Access

Claudia worked in the billing department of a VA hospital for three years.

She recently transferred to another job and no longer needs access to the billing system. A friend asked her for help on some charges she didn’t think were correct. Claudia checked and discovered that she still has access to the billing system.

What should Claudia do next?

Determine the best answer from the options below:

A. She should log out of the billing system and immediately notify her supervisor that she still has access to the system.

B. She should log out of the billing system and get back to her current tasking.

C. She should look at the billing system to verify that her friend was charged appropriately.

Correct Feedback The correct answer A.

She should log out and immediately notify her supervisor that she still has access to the billing system.

Employees must use their access to VA computer systems and records only for assigned duties. Since Claudia no longer works in billing, she no longer has the right to access the billing system. To avoid becoming an insider threat, you must notify your VA supervisor (or designee) any time you have access to a system you no longer need. Failing to do so exposes PII, invades the privacy of patients, causes potential risk to VA, and violates the need-to-know rule.

FY19 Text-Only Course Transcript 15

Rules of Behavior Review the associated rules for your user type below.

Organizational Users

• I WILL only use my access to VA computer systems and/or records for officially authorized and assigned duties.

Non-Organizational Users

• I WILL only use my access to VA computer systems and/or records for officially authorized purposes.

Organizational and Non-Organizational Users

• I WILL follow established procedures for requesting access to any VA information system and for notifying VA when the access is no longer needed.

3.6 Protecting Systems

Not only are we all responsible for accessing systems properly, we are also responsible for protecting those systems to minimize the potential for compromise.

The scenarios in this section include situations when you have to make the right choice to protect VA information systems.

3.7 Securing Your VA Workstation

Scenario Vincent had been working with printed and electronic reports containing patient sensitive information all day. After receiving an urgent call from his daughter’s school, he quickly put the printed material in his desk drawer, gathered his personal belongings, and left without closing the electronic files or signing off his computer. He didn’t even think to grab his PIV card.

Did Vincent’s actions violate the ROBs?

Determine the best answer from the options below:

A. Yes. His actions made sensitive information vulnerable to anyone with access to his office.

B. No. He put the printed materials out of sight in his desk drawer and his VA computer will lock automatically due to inactivity.

Correct Feedback The correct answer is A.

Vincent’s actions violated the ROBs and put sensitive information at risk. The ROBs require him to log out of all information systems at the end of each workday and to secure his PIV card.

FY19 Text-Only Course Transcript 16

Never leave PIV cards exposed; besides providing potential access to VA systems, it could provide access to restricted facility locations. Ensure that you only use approved methods to gain access to secured areas.

Always remember to maintain a clean desk policy to ensure you do not leave VA sensitive information on your desk during the day or when you leave for the day. Be sure to lock all doors when the office is unattended.

Rules of Behavior Review the associated rules for your user type below.

Organizational Users

• I WILL log out of all information systems at the end of each workday.

• I WILL log off or lock any VA computer or console before walking away.

• I WILL ensure that all printed material containing VA sensitive information is physically secured when not in use (e.g., locked cabinet, locked door).

3.8 Data Protection Software

Scenario Michelle is doing some work on her VA-issued laptop that requires research on the internet. While on one of the sites, a pop-up appears saying that her computer is running slow and prompts her to click the link on the page to fix it.

Do you think she needs to check with her ISSO?

Determine the best answer from the options below:

A. Yes, it’s better to ask her ISSO than to ignore a potential threat.

B. No, this message wouldn’t display if there wasn’t a good reason.

Correct Feedback The correct answer is A.

Michelle should check with her ISSO. It’s a good thing Michelle was cautious because this could be a sign of a ransomware attack. While there is virus protection software on your VA devices, cyber threats evolve so quickly, there’s no way to catch everything. As a note, you should never use any virus protection software, anti-spyware, or firewall/intrusion detection software that is not authorized by VA.

Here are three ways you can determine if a website is real. First, pay close attention to the URL. The address bar contains important information about your location and the security of the information you plan to access. Second, check the connection indicators. The address bar provides information to let you know that your connection to a website is private. Only websites that use “https” combined with a green padlock icon should be trusted with your personal information. Third, look for grammatical errors.

Poor English or grammatical errors could indicate that the site is not real.

FY19 Text-Only Course Transcript 17

Organizational Users

• I WILL only use virus protection software, anti-spyware, and firewall/intrusion detection software authorized by VA.

Non-Organizational Users

• I WILL, if authorized to directly connect to a VA system, only use virus protection software, anti-spyware, and firewall/intrusion detection software authorized by VA.

Organizational and Non-Organizational Users

• I WILL NOT disable or degrade software programs used by VA that install security software updates to VA computer equipment, to computer equipment used to connect to VA information systems, or used to create, store or use VA information.

3.9 Connecting to the Network Using a Non-GFE Computer

System Scenario Tony is a new contractor at a VA facility who will be working both on and off site. His role will require him to access sensitive information. As stated in the contract, he will not be issued government-furnished equipment (GFE), such as a laptop, and therefore will be using his corporate computer and his PIV card.

Will Tony be able to connect to the VA network when he is on site?

Determine the best answer from the options below:

A. Yes, as long as he only uses VA-approved solutions for connecting his non-VA-owned system to VA's network.

B. No. Only VA-issued equipment is allowed to connect to VA’s network.

Correct Feedback The correct answer is A.

As long as Tony gets the proper approval from the Contracting Officer’s Representative (COR), Area Manager, and Information Technology and Operations (ITOPS) and uses a VA-approved solution to connect, he will be able to connect to the VA network with his corporate computer.

FY19 Text-Only Course Transcript 18

Organizational Users

• I WILL only use VA-approved solutions for connecting non-VA-owned systems to VA's network.

• I WILL obtain approval prior to using remote access capabilities to connect non-GFE equipment to VA's network while within the VA facility.

Non-Organizational Users

• I WILL only use VA-approved solutions, software, or services for connecting non-VA-owned systems to VA’s network either remotely or directly.

• I WILL NOT use personally-owned equipment on-site at a VA facility to directly connect to the VA network, or connect remotely to the VA network unless approved prior to use (i.e., approval from VA ISO* or Change Management Agent).

*Note: 1) The Information Security Officer (ISO) role is now referred to as Information System Security Officer (ISSO).

3.10 Summary

Think about accessing VA information systems the same way as you would be operating a motor vehicle. It’s not a right that you get to do so; it’s a privilege. As a user, you are required to abide by the ROBs that advise how to keep VA information systems safe and protected, just as you are required to follow traffic laws.

When accessing VA information systems, be sure to do the following:

• Protect your credentials; this includes your personal user name, password and PIN, access and verify codes, or other access credential.

• Keep your PIV card secure.

• Only access systems you are permitted to use to do your current job.

• Use only VA-authorized virus protection software, anti-spyware, and firewall/intrusion detection software.

• Only connect approved devices, using approved methods, to VA networks and systems.

FY19 Text-Only Course Transcript 19

Topic 4: Protecting VA Computer Resources

4.1 Introduction

Whether you are issued VA-owned devices or equipment or you just work with them, you must take responsibility for their care and protection. Keep in mind that your journey is not yours alone. You are protecting the security, identity, and privacy of not only yourself but of every single person at VA, VA as a whole, and the Veterans we serve.

On this stop of your journey, you will find situations that deal with proper use and maintenance of VA devices and equipment.

It also includes best practices and recertification for users of VA-provided Apple (iOS) mobile devices.

When you have completed this topic, you will be able to do the following:

• Recall how to use VA-issued devices securely to prevent risk of exposing VA sensitive information

• Identify how to store, transport, and dispose of any media containing VA sensitive information

• Identify best practices and recertification for users of VA-provided Apple (iOS) mobile devices

4.2 Protecting VA-Issued Devices

You are an important line of defense at VA. Be diligent about protecting VA equipment and the information your devices contain.

The scenarios in this section will require you to make the right decisions to protect VA-issued computers and devices.

4.3 Downloading Software

Scenario Ian is a VA employee. He and a friend are in the same role but support different offices. His friend mentions that he’s part of an online gaming group that plays during lunch hours. He asks Ian if he would like to join. He tells Ian that if he’s interested, he can download the game to his VA-issued computer, and then his friend provides the URL. Ian decides to join and tries to download the game, but the download is denied.

Were Ian’s actions appropriate?

Determine the best answer from the options below:

A. Yes. The group doesn’t play during working hours.

B. No. Downloading software from the internet poses a security risk.

Correct Feedback

FY19 Text-Only Course Transcript 20

Ian’s actions were not appropriate. The fact is, he doesn’t have the authority to download the game to his computer. Plus, the ROBs prohibit Ian from downloading software from the internet to a VA-owned system. His actions could result in loss of use or limitations on use of equipment and disciplinary or adverse actions.

If Ian needs a download for his job, he will go through ServiceNow to submit a ticket.

For mobile devices, download apps from the Apple App Store ONLY if you are not receiving or inputting VA sensitive information. Only apps from the VA App Catalog have been deemed safe for use with VA sensitive information and for conducting VA business.

Do not use any software or services that you are not authorized to use—including those that require licensing or have copyright restrictions.

While downloading games to a VA-issued device is not appropriate, you can protect your identity on your own devices by using strong passwords for every site you visit often. Use numbers, letters, special characters, or some kind of phrase known only to you. Also, keep your social media identity limited.

Never include detailed personal information on any social media website.

Rules of Behavior Review the associated rules for your user type below.

Organizational Users

• I WILL use only VA-approved devices, systems, software, services, and data which I am authorized to use, including complying with any software licensing or copyright restrictions.

• I WILL permit only those authorized by OlT to perform maintenance on IT components, including installation or removal of hardware or software.

• I WILL NOT download software from the Internet, or other public available sources, offered as free trials, shareware; or other unlicensed software to a VA-owned system.

Non-Organizational Users

• I WILL permit only those authorized by OIT to perform maintenance on GFE or VA IT components, including installation or removal of hardware or software.

• I WILL NOT download or install prohibited software from the Internet, or other publicly available sources, offered as free trials, shareware, or other unlicensed software to a VA-owned system.

FY19 Text-Only Course Transcript 21

4.4 Limited Personal Use

Brianna is a clerk at the Veterans Benefits Administration (VBA). During a very slow day at work, she printed out two hundred flyers about upcoming neighborhood community outreach events for distribution to her community club members.

Was Brianna’s personal use of her work computer acceptable?

Determine the best answer from the options below:

A. Yes. Brianna’s personal use of her printing flyers did not interfere with her work responsibilities.

B. No. Brianna’s personal use involved prohibited activities.

Correct Feedback The correct answer is B.

Brianna’s personal use of her work computer was not acceptable. Using government equipment during work hours and excessive use of consumables are violations of VA Directive 6001, Limited Personal Use of Government Office Equipment Including Information Technology.

Rules of Behavior Review the associated rule for your user type below.

Organizational Users

• I WILL NOT engage in any activity that is prohibited by VA Directive 6001, Limited Personal Use of Government Office Equipment Including Information Technology.

4.5 Unauthorized Visitors and Stolen Laptop

Scenario During her daily rounds of IT inventory inspection, Wendy notices some unfamiliar people in the area. She asks a few coworkers who they are but no one seems to know. She feels as if she needs to confirm that the strangers are authorized to be in the area but is called away to a meeting.

When she returns to her work on the inventory inspection, she finds that a laptop is missing.

Which of the following would have been the best approach to prevent the theft of the laptop?

Determine the best answer from the options below:

A. Wendy could have approached the strangers and asked who they were.

FY19 Text-Only Course Transcript 22

B. Wendy could have asked the strangers to leave the area.

C. Wendy could have approached the strangers and asked to see their VA PIV cards.

Correct Feedback The correct answer is C.

This is the most vigilant approach. Wendy should have asked for proof that they were authorized to be in the area when she didn’t see their PIV cards. PIV cards should always be visible above the waist. If she had discovered that they weren’t authorized to be in the area, she could have immediately escalated the situation to the facility’s security staff.

VA staff should be vigilant to ensure only authorized personnel are in their work areas to help prevent theft and unauthorized access to sensitive information and systems.

Rules of Behavior Review the associated rule for your user type below.

Non-Organizational Users

• I WILL protect Government Furnished Equipment (GFE) from theft, loss, destruction, misuse, and threats.

4.6 Stolen or Missing Equipment

Scenario Hank was getting ready to travel on VA business, so he signed out a VA laptop. Because he would be dealing with sensitive information, he made sure it had the newest, validated encryption.

When he stopped for lunch, he took the laptop with him into the restaurant.

No one was sitting near him, so he placed the laptop on his chair and left to order his food at the counter. When he returned, the laptop was gone.

Which of the following approaches should Hank have taken to prevent the theft of the laptop?

Determine the best answer from the options below:

A. Hank should have asked the hostess to keep an eye on the laptop.

B. Hank should have carried the laptop with him.

Correct Feedback The correct answer is B.

In this scenario, Hank should have kept the laptop with him to avoid theft. While keeping mobile and storage devices with you at all times is ideal, it isn’t always convenient. Alternatively, Hank could have secured the laptop with a cable lock in the trunk of his car to prevent the theft. Theft is often a crime of opportunity. Don’t allow someone to take advantage of you.

FY19 Text-Only Course Transcript 23

In the event of theft, remember to report any missing or stolen VA equipment as soon as the loss is discovered. This includes encrypted or unencrypted laptops, tablets, flash drives, and phones.

Rules of Behavior Review the associated rules for your user type below.

Organizational Users

• I WILL safeguard VA mobile devices and portable storage devices containing VA information, at work and remotely, using FIPS 140-2 validated encryption (or its successor) unless it is not technically possible. This includes laptops, flash drives, and other removable storage devices and storage media (e.g., Compact Discs (CD), Digital Video Discs (DVD)).

• I WILL secure mobile devices and portable storage devices (e.g., laptops, Universal Serial Bus [USB] flash drives, smartphones, tablets, personal digital assistants [PDA]).

Non-Organizational Users

• I WILL protect Government Furnished Equipment (GFE) from theft, loss, destruction, misuse, and threats.

4.7 Disposing of Old Flash Drives

Scenario Larry’s old VA-issued flash drive malfunctioned, and he had to get a new one. Instead of simply discarding the old one, he contacted the Office of Information Technology (OIT) to make arrangements to turn it in to an authorized OIT representative.

Did…