Appendix F Additional Security 1-4-1.pdf

APPENDIX F TO VHA HANDBOOK 6500 APPENDIX F ADDITIONAL SECURITY

INFORMATION FOR AIR-GAPPED MOU FOR VA PROVIDED INTERNET ACCESS

SECTION 1.4.1 SECURITY

1.4.1. Security

The parties agree to work together to ensure the security of TOM-VHA.

System Security Considerations and Parameters for VA wired and/or wireless public Internet access services.

• Advisory Banner Implementation:

Insert a screen shot of advisory banner. Approved public banners and guidance are located in VA Handbooks 6102 ( VHA Handbook 6102 ) and 6500 ( VHA Handbook 6500 ).

Implementation Guidance

The Information System Owner, local Chief Information Officer (CIO), or designee must select and configure the operating system to display a warning banner screen (or close approximation) at log in, and require users to electronically acknowledge the warning, such as clicking an “OK” or “I agree” button to proceed. Banners can also be posted in the physical location of the network and/or user sign-in sheets.

Banner/User Agreement: See Pages F-25 and F-26, Section AC-8: System Use Notification (P1), of Appendix F, in the VA Handbook 6500 for a template of the Banner/User Agreement.

• Identify Security Solutions and Content Filtering Solutions:

Document security solutions and content filtering solutions used to mitigate risk. Include the identification of the application (Surf Control, etc.) and selected content filtering options. Changes can be made as necessary based upon audit log review results.

• Identify Physical Security Controls:

Document what physical security controls are used to protect the wired and/or wireless Internet public Internet. (Examples are locked doors, CCTV Cameras, or VA Security Points of Contact ((POC(s)) for monitoring user activities. Computers may also be positioned in a location where the site manager may monitor computer activities.

Document the location of the Physical security controls in Appendix E.

• Additional Requirements for Domiciliary Settings, Access Control Implementation:

For domiciliary settings, implement user agreements, advisory banners, access controls including user name and password. (This may be implemented as a physical login book)

1.

https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2 https://vaww.va.gov/6102/vawebbestpracticesguide.pdf https://vaww.saginaw.va.gov/docs/vahandbook6500.pdf https://vaww.saginaw.va.gov/docs/vahandbook6500.pdf

Audit Trail Responsibilities The information system provides the capability for authorized users to capture/record and log content related to a user session. Organizations retain audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on record retention.

• Security Logging Parameters: Explain what and how the logs are captured and maintained. What information is logged (i.e. access controls, users, duration, search/URL history, and login attempts).

• Audit Log(s) Review: Provide the frequency that the audit log will be reviewed by the

VA.

• Audit Log Storage - Log files must be maintained for a one-year period: Identify how and where the audit logs are stored.

The facility may implement these services through existing Internet service provider and the service provider must be able to provide log file as requested for investigation.

APPENDIX F TO VHA HANDBOOK 6500 APPENDIX F ADDITIONAL SECURITY INFORMATION FOR AIR-GAPPED MOU FOR VA PROVIDED INTERNET ACCESS SECTION 1.4.1 SECURITY