Produced by Araxis Merge on 5/28/2019 3:18:13 PM Eastern Daylight Time. See www.araxis.com for information about Merge. This report uses XHTML and CSS2, and is best viewed with a modern standards-compliant browser. For optimum results when printing this report, use landscape orientation and enable printing of background images and colours in your browser.
# | Location | File | Last Modified |
---|---|---|---|
1 | CV_src.zip\CV-CCP\web-app\resources | 31167_FY17_VA_Privacy_and_Information_Sec_Awareness_ROB_PDF_11-07-2016_V3.0.0.docx | Tue May 28 17:06:26 2019 UTC |
2 | CV_src.zip\CV-CCP\web-app\resources | 31167_FY17_VA_Privacy_and_Information_Sec_Awareness_ROB_PDF_11-07-2016_V3.0.0.docx | Tue May 28 17:14:28 2019 UTC |
Description | Between Files 1 and 2 |
|
---|---|---|
Text Blocks | Lines | |
Unchanged | 17 | 5194 |
Changed | 16 | 38 |
Inserted | 0 | 0 |
Removed | 0 | 0 |
Whitespace | |
---|---|
Character case | Differences in character case are significant |
Line endings | Differences in line endings (CR and LF characters) are ignored |
CR/LF characters | Not shown in the comparison detail |
No regular expressions were active.
1 | VA Privacy and Infor mation Sec urity Awar eness and Rules of B ehavior | |
2 | Making the Connectio n | |
3 | ||
4 | ||
5 | ||
6 | ||
7 | ||
8 | FY17 Text- Only Cours e Transcri pt | |
9 | ||
10 | ||
11 | ||
12 | ||
13 | ||
14 | Department of Vetera ns Affairs Office of Informati on and Tec hnology IT Workforce Developme nt | |
15 | ||
16 | ||
17 | Table of C ontents | |
18 | ||
19 | Table of C ontentsi | |
20 | Purpose of This Docu ment1 | |
21 | Using Hype rlinks Wit hin This D ocument1 | |
22 | Module 1: Welcome2 | |
23 | Who Must T ake This C ourse2 | |
24 | Federal Re quirements 3 | |
25 | Course Obj ectives4 | |
26 | Module 2: Privacy an d Security Basics6 | |
27 | Objectives 6 | |
28 | Privacy an d Informat ion Securi ty Require ments6 | |
29 | Types of V A Sensitiv e Informat ion8 | |
30 | Federal Re cords10 | |
31 | Knowledge Check: Typ es of VA S ensitive I nformation 11 | |
32 | Continuous Readiness in Inform ation Secu rity Progr am11 | |
33 | Passwords1 2 | |
34 | Personal I dentity Ve rification 13 | |
35 | Making the Connectio n: Natalie ’s Story14 | |
36 | What Is Tw o-Factor A uthenticat ion?14 | |
37 | Securing P aper and E lectronic Files15 | |
38 | Who Can He lp?16 | |
39 | Connecting Points17 | |
40 | Module 3. Risks in t he Digital Age19 | |
41 | Objectives 19 | |
42 | Texting19 | |
43 | Instant Me ssaging (I M)20 | |
44 | Interactiv e Exercise #1: Sendi ng IMs Sec urely21 | |
45 | Interactiv e Exercise #2: Sendi ng IMs Sec urely22 | |
46 | Interactiv e Exercise #3: Sendi ng IMs Sec urely23 | |
47 | Social Med ia23 | |
48 | Knowledge Check: Usi ng Social Media to C onduct Bus iness25 | |
49 | Hacking25 | |
50 | Social Eng ineering27 | |
51 | Phishing28 | |
52 | Knowledge Check: Phi shing29 | |
53 | Making the Connectio n: Mr. and Mrs. Sala zar’s Stor y30 | |
54 | Identity T heft30 | |
55 | Connecting Points31 | |
56 | Module 4: Using Syst ems Secure ly33 | |
57 | Objectives 33 | |
58 | VA Network s33 | |
59 | Wireless N etworks34 | |
60 | Remote Acc ess35 | |
61 | Network Ac cess While Traveling Outside t he United States37 | |
62 | Telework G uidance38 | |
63 | Knowledge Check: Rem ote Access 39 | |
64 | Risks and Threats39 | |
65 | Making the Connectio n: Wendy’s Story42 | |
66 | Insider Th reats42 | |
67 | Preventing Attacks43 | |
68 | Interactiv e Exercise #1: Preve nting Atta cks45 | |
69 | Interactiv e Exercise #2: Preve nting Atta cks45 | |
70 | Interactiv e Exercise #3: Preve nting Atta cks46 | |
71 | Connecting Points46 | |
72 | Module 5: Using Equi pment and Devices Se curely47 | |
73 | Objectives 47 | |
74 | Making the Connectio n: Christo pher’s Sto ry47 | |
75 | Inventory Control fo r Electron ic Devices 47 | |
76 | Medical De vices49 | |
77 | Using VA-I ssued Devi ces Secure ly50 | |
78 | Policy and Use of VA -Issued De vices52 | |
79 | Privacy an d Security on VA Mob ile Device s54 | |
80 | Apps55 | |
81 | Interactiv e Exercise #1: VA-Is sued Devic es57 | |
82 | Interactiv e Exercise #2: VA-Is sued Devic es58 | |
83 | Interactiv e Exercise #3: VA-Is sued Devic es58 | |
84 | Personal E lectronic Devices59 | |
85 | Unencrypte d Devices6 0 | |
86 | Portable S torage and Removable Media61 | |
87 | Knowledge Check: Per sonal Elec tronic Dev ices63 | |
88 | Connecting Points63 | |
89 | Module 6. Conversati ons and Em ail64 | |
90 | Objectives 64 | |
91 | Making the Connectio n: Tony’s Story64 | |
92 | Face-to-Fa ce and Pho ne Convers ations64 | |
93 | Securing E mail65 | |
94 | Prohibited Use of Pe rsonal Ema il67 | |
95 | Electronic Calendar and Invita tions68 | |
96 | Knowledge Check: Ele ctronic Ca lendars an d Invitati ons69 | |
97 | Connecting Points69 | |
98 | Module 7: Handling P aper and E lectronic Documents7 0 | |
99 | Objectives 70 | |
100 | Making the Connectio n: Tanya’s Story70 | |
101 | Requiremen ts for Han dling Pape r Document s70 | |
102 | Records72 | |
103 | Faxing74 | |
104 | Mailings75 | |
105 | Making the Connectio n: Sarah’s Story76 | |
106 | Consolidat ed Mail Ou tpatient P harmacy (C MOP)77 | |
107 | Electronic Files77 | |
108 | Electronic Records78 | |
109 | Microsoft SharePoint 79 | |
110 | Transporti ng VA Sens itive Info rmation80 | |
111 | Knowledge Check: Tra nsporting Informatio n81 | |
112 | Connecting Points81 | |
113 | Module 8. Recognizin g and Repo rting Inci dents82 | |
114 | Objectives 82 | |
115 | What Are I ncidents?8 2 | |
116 | Consequenc es if You Cause an I ncident83 | |
117 | Severe Pen alties84 | |
118 | Making the Connectio n: Dr. Saw yer’s Stor y85 | |
119 | Steps for Reporting Suspected Incidents8 5 | |
120 | Knowledge Check: Ste ps for Rep orting Sus pected Inc idents86 | |
121 | Other Reso urces to R eport Inci dents86 | |
122 | Connecting Points86 | |
123 | Module 9. Course Sum mary and R ules of Be havior88 | |
124 | Course Sum mary88 | |
125 | Acknowledg e, Accept, and Compl y With the ROB88 | |
126 | Course Com pletion89 | |
127 | ||
128 | APPENDIX A : Departme nt of Vete ran Affair s Informat ion Securi ty Rules o f Behavior ......... .......... .......... .......... .......... .......... .......... .......... .. A-1 | |
129 | APPENDIX B : Glossary ......... .......... .......... .......... .......... .......... .......... ... B-1 | |
130 | APPENDIX C : Privacy and Inform ation Secu rity Resou rces ..... ........ C -1 | |
131 | ||
132 | ||
133 | Purpose of This Docu ment | |
134 | This text- only cours e transcri pt was des igned to a ccommodate users in any of the se circums tances: | |
135 | You are us ing a scre en reader, such as J AWS, to co mplete cou rse materi al and hav e difficul ty with th e interact ions in th e online v ersion. | |
136 | You are ex periencing difficult ies access ing the on line versi on due to computer n etwork or bandwidth issues. | |
137 | You have c ompleted t he online version an d want to print a co py of cour se materia l for refe rence. | |
138 | This versi on of the VA Privacy and Infor mation Sec urity Awar eness and Rules of B ehavior Te xt-Only Co urse Trans cript is v alid for f iscal year (FY) 2017 (i.e., Oc tober 2016 through S eptember 2 017). | |
139 | You should take the online ver sion of th is course if possibl e. However , if you c omplete th e course u sing this text-only transcript , you must do the fo llowing: | |
140 | Print and sign the I nformation Security Rules of B ehavior (R OB), as we ll as init ial each p age in the space pro vided | |
141 | Contact yo ur supervi sor or Con tracting O fficer Rep resentativ e (COR) to submit th e signed R OB and to coordinate with your local Tal ent Manage ment Syste m (TMS) Ad ministrato r to ensur e you rece ive credit for compl etion. | |
142 | Using Hype rlinks Wit hin This D ocument | |
143 | Throughout this docu ment, you are able t o access m ore detail ed informa tion and t he knowled ge checks by selecti ng the ava ilable hyp erlinks. T o return t o your pla ce in the main docum ent after selecting a hyperlin k to an it em in the appendix, select Alt + | |
144 | <left arro w> on your keyboard. | |
145 | ||
146 | ||
147 | Module 1: Welcome | |
148 | Welcome to VA Privac y and Info rmation Se curity Awa reness and Rules of Behavior. | |
149 | ||
150 | Who Must T ake This C ourse | |
151 | This cours e is all a bout makin g a connec tion betwe en your kn owledge an d the thin gs you can do every day to mak e a differ ence for V eterans. V A must com ply with f ederal law s about pr ivacy and informatio n security . Everyone who comes in contac t with inf ormation a nd informa tion syste ms at VA h as a duty to protect privacy a nd ensure informatio n security . | |
152 | This cours e will hel p you unde rstand you r roles an d responsi bilities f or protect ing VA inf ormation. You must c omplete th is trainin g to use o r gain acc ess to VA informatio n or infor mation sys tems. To m aintain yo ur access, you must complete t his traini ng each ye ar. | |
153 | Those who use VA inf ormation o r VA infor mation sys tems must take this training, including: | |
154 | Organizati onal users | |
155 | Organizati onal users are ident ified as V A employee s, contrac tors, rese archer, st udents, vo lunteers, and repres entatives of Federal , state, l ocal or tr ibal agenc ies. | |
156 | Non-organi zational u sers | |
157 | Non-organi zational u sers are i dentified as all inf ormation s ystem user s other th an VA user s explicit ly categor ized as or ganization al users. | |
158 | There are some excep tions to u sers who m ust take t his traini ng: | |
159 | ||
160 | Students o r other tr ainees | |
161 | If you are a health profession s trainee (i.e., stu dent, inte rn, reside nt, or fel low), you are not re quired to complete t his course , but you must compl ete the co urse VHA M andatory T raining fo r Trainees -Refresher (VA TMS I D: 3192008 ). | |
162 | VHA and VB A employee s and cont ractors | |
163 | If you hav e access t o Protecte d Health I nformation (PHI), yo u are also required to complet e the Priv acy and HI PAA Focuse d Training (VA TMS I D: 10203). | |
164 | Rules of B ehavior (R OB) | |
165 | ||
166 | 1. COVERAG E | |
167 | ||
168 | 1b. Organi zational u sers are i dentified as VA empl oyees, con tractors, researcher , students , voluntee rs, and re presentati ves of Fed eral, stat e, local o r tribal a gencies. | |
169 | 1c. Non-or ganization al users a re identif ied as all informati on system users othe r than VA users expl icitly cat egorized a s organiza tional use rs. | |
170 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
171 | I Will: | |
172 | ||
173 | Comply wit h all fede ral VA inf ormation s ecurity, p rivacy, an d records management policies. SOURCE: P M-1 | |
174 | Have NO ex pectation of privacy in any re cords that I create or in my a ctivities while acce ssing or u sing VA in formation systems. S OURCE: AC- 8 | |
175 | User Accou ntability | |
176 | ||
177 | I Will: | |
178 | ||
179 | Complete m andatory s ecurity an d privacy awareness training w ithin desi gnated tim e frames, and comple te any add itional ro le-based s ecurity tr aining req uired base d on my ro le and res ponsibilit ies. SOURC E: AT-3 | |
180 | Federal Re quirements | |
181 | Many laws require pr ivacy and informatio n security training, including : | |
182 | ||
183 | Privacy Ac t of 1974 | |
184 | Health Ins urance Por tability a nd Account ability Ac t (HIPAA) | |
185 | Federal In formation Security M anagement Act (FISMA ) | |
186 | ||
187 | Many other federal l aws are re lated to p rivacy, re cords and informatio n manageme nt, and in formation security, including: | |
188 | Health Inf ormation T echnology for Econom ic and Cli nical Heal th Act (HI TECH) | |
189 | Federal Re cords Act of 1950 | |
190 | Freedom of Informati on Act (FO IA) | |
191 | ||
192 | You can fi nd more in formation in Appendi x C, Priva cy and Inf ormation S ecurity Re sources. | |
193 | Rules of B ehavior | |
194 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R | |
195 | ||
196 | User Accou ntability | |
197 | ||
198 | I Will: | |
199 | ||
200 | Complete m andatory s ecurity an d privacy awareness training w ithin desi gnated tim e frames, and comple te any add itional ro le-based s ecurity tr aining req uired base d on my ro le and res ponsibilit ies. SOURC E: AT-3 | |
201 | Course Obj ectives | |
202 | Evolving c omputer te chnologies and tools increase the speed and effect iveness of providing services to Veteran s. At the same time, new risks are a par t of every new oppor tunity. Yo u must be aware of t hese risks at all ti mes and be ready to protect se nsitive in formation and system s. | |
203 | When you h ave finish ed this co urse, you will be ab le to: | |
204 | ||
205 | Identify t he types o f VA infor mation and informati on systems you are r equired to protect | |
206 | Recall the steps you must take to protec t personal privacy, VA sensiti ve informa tion, and informatio n security | |
207 | Recognize the penalt ies you ma y face for failing t o protect privacy an d security | |
208 | Identify i ncidents a nd recall the proces s for repo rting inci dents that can compr omise or p ossibly im pact priva cy and sec urity | |
209 | Acknowledg e, accept, and compl y with the ROB | |
210 | ||
211 | You will b e able to make the c onnection between yo ur actions and the c onfidence Veterans c an feel to ward VA. Y ou make th at confide nce connec tion for V eterans by knowing t he Rules o f Behavior and remem bering to follow the m. | |
212 | Rules of B ehavior | |
213 | ||
214 | 1. COVERAG E | |
215 | ||
216 | 1a. Depart ment of Ve terans Aff airs (VA) Informatio n Security Rules of Behavior ( ROB) provi des the sp ecific res ponsibilit ies and ex pected beh avior for organizati onal users and non-o rganizatio nal users of VA syst ems and VA informati on as requ ired by 0M B Circula r A-130, A ppendix Il l, paragra ph 3a(2)(a ) and VA H andbook 65 00, Managi ng Informa tion Secur ity Risk: VA Informa tion Secur ity Progra m. | |
217 | 1d. VA Inf ormation S ecurity RO B does not supersede any polic ies of VA facilities or other agency com ponents th at provide higher le vels of pr otection t o VA's inf ormation o r informat ion system s. The VA Informatio n Security ROB provi des the mi nimal rule s with | |
218 | ||
219 | which indi vidual use rs must co mply. Auth orized use rs are req uired to g o beyond s tated rule s using "d ue diligen ce" and th e highest ethical st andards. | |
220 | ACKNOWLEDG EMENT | |
221 | ||
222 | 3a. VA Inf ormation S ecurity RO B must be signed bef ore access is provid ed to VA i nformation systems o r VA infor mation. Th e VA ROB m ust be sig ned annual ly by all users of V A informat ion system s or VA in formation. This sign ature indi cates agre ement to a dhere to t he VA ROB. Refusal t o sign VA Informatio n Security ROB will result in denied acc ess to VA informatio n systems or VA info rmation. A ny refusal to sign t he VA Info rmation Se curity ROB may have an adverse impact on employmen t with VA. | |
223 | INFORMATIO N SECURITY RULES of BEHAVIOR Access and Use of VA Informati on Systems | |
224 | I Will: | |
225 | ||
226 | Comply wit h all fede ral VA inf ormation s ecurity, p rivacy, an d records management policies. SOURCE: P M-1 | |
227 | ||
228 | ||
229 | Module 2: Privacy an d Security Basics | |
230 | Objectives | |
231 | Veterans a nd their f amilies de pend on yo u to prote ct their p rivacy and personal informatio n. Becomin g aware of the risks and threa ts to priv acy and in formation security i s the firs t step to keeping Ve terans’ tr ust in VA. | |
232 | When you h ave comple ted this t opic, you will be ab le to: | |
233 | ||
234 | Recall the types of VA sensiti ve informa tion | |
235 | Identify b asic ways to protect VA sensit ive inform ation | |
236 | ||
237 | Privacy an d Informat ion Securi ty Require ments | |
238 | You have a responsib ility to p rotect pri vacy and m aintain in formation security. Informatio n security is a set of princip les and ac tions that ensure VA informati on systems and VA se nsitive in formation are only a ccessed by authorize d people o r systems and are av ailable wh en you nee d them. | |
239 | You must p rotect all types of VA sensiti ve informa tion when you are: | |
240 | ||
241 | Talking wi th others | |
242 | Handling p aper docum ents or el ectronic f iles | |
243 | Using emai l and othe r types of electroni c messagin g | |
244 | Using VA s ystems | |
245 | Using elec tronic equ ipment and devices | |
246 | Using info rmation te chnologies , such as the Intern et and soc ial media | |
247 | ||
248 | You are re quired to uphold the se respons ibilities and follow the law. You are al so require d to repor t whenever you suspe ct or noti ce these r equirement s are not being foll owed. If y ou do not follow the rules and report in cidents, y ou could f ace penalt ies, have to pay fin es, lose y our job, o r even fac e prison t ime. | |
249 | Penalties | |
250 | Privacy Ac t penaltie s include up to $5,0 00 in fine s and a ye ar in pris on per vio lation. HI PAA violat ions may r esult in f ines from $100 to $1 .5 million and jail time. FISM A noncompl iance can result in loss of fu nding and contracts. | |
251 | These thre e concepts are impor tant: conf identialit y, integri ty, and av ailability . | |
252 | ||
253 | Confidenti ality | |
254 | Confidenti ality mean s informat ion must n ot be disc losed to p eople who do not hav e permissi on or lega l authorit y to know it. For ex ample, VA sensitive informatio n should n ot be made public. | |
255 | Integrity | |
256 | Integrity means all VA sensiti ve informa tion is ke pt from be ing damage d, destroy ed, or imp roperly ch anged. | |
257 | Availabili ty | |
258 | Availabili ty means p eople with permissio n can acce ss informa tion, info rmation sy stems, and networks when they need them. | |
259 | Rules of B ehavior | |
260 | 2. COMPLIA NCE | |
261 | ||
262 | 2a. Non-co mpliance w ith VA ROB may be ca use for di sciplinary actions. Depending on the sev erity of t he violati on and man agement di scretion, consequenc es may inc lude restr icting acc ess, suspe nsion of a ccess priv ileges, re primand, d emotion an d suspensi on from wo rk. Theft, conversio n, or unau thorized d isposal or destructi on of Fede ral proper ty or info rmation ma y result i n criminal sanctions . | |
263 | 2b. Unauth orized acc essing, up loading, d ownloading , changing , circumve nting, or deleting o f informat ion on VA systems; u nauthorize d modifyin g VA syste ms, denyin g or grant ing access to VA sys tems; usin g VA resou rces for u nauthorize d use on V A systems; or otherw ise misusi ng VA syst ems or res ources is strictly p rohibited. | |
264 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
265 | I Will Not : | |
266 | ||
267 | Engage in any activi ty that is prohibite d by VA Di rective 60 01, Limite d Personal Use of Go vernment O ffice Equi pment Incl uding Info rmation Te chnology. SOURCE: AC -8 | |
268 | Incident R eporting | |
269 | ||
270 | I Will: | |
271 | ||
272 | Report sus pected or identified informati on securit y incident s includin g anti-vir us, antisp yware, fir ewall or i ntrusion d etection s oftware er rors, or s ignificant alert | |
273 | ||
274 | messages ( security a nd privacy ) to my VA superviso r or desig nee immedi ately upon suspicion . SOURCE: IR-6 | |
275 | Types of V A Sensitiv e Informat ion | |
276 | It is your responsib ility to p rotect pri vacy. That means you do not di sclose, al ter, or de stroy VA s ensitive i nformation unless yo u have per mission fr om your su pervisor, Privacy Of ficer (PO) , Informat ion Securi ty Officer (ISO), or records m anagement official. Veterans a re countin g on you. | |
277 | Personally Identifia ble Inform ation (PII ) and Sens itive Pers onal Infor mation (SP I) | |
278 | Personally Identifia ble Inform ation (PII ), also ca lled Sensi tive Perso nal Inform ation (SPI ), refers to informa tion about a specifi c person, such as: | |
279 | Name, home address, and home p hone numbe r | |
280 | Social Sec urity numb er | |
281 | Date of bi rth | |
282 | Credit car d numbers | |
283 | Education records | |
284 | Financial records | |
285 | Criminal a nd employm ent histor ies | |
286 | ||
287 | Protected Health Inf ormation ( PHI) | |
288 | Protected Health Inf ormation ( PHI) inclu des health records o r payment informatio n linked t o a specif ic person, such as: | |
289 | Patient me dical reco rds | |
290 | Patient ap pointment reminders | |
291 | Patient di agnoses | |
292 | Patient te st results | |
293 | Patient pa yment hist ory | |
294 | ||
295 | Regulatory or progra m-specific informati on | |
296 | Regulatory or progra m-specific informati on is info rmation th at may not be releas ed or may only be re leased in certain si tuations. This categ ory of inf ormation w ould not n ormally be released to the pub lic. Examp les includ e: | |
297 | Certain me dical qual ity assura nce record s | |
298 | Names and addresses of active duty membe rs, Vetera ns, and th eir depend ents | |
299 | ||
300 | ||
301 | VA informa tion techn ology (IT) internal systems in formation revealing informatio n about ho w systems are set up . Examples include f ramework u sed for se rvers, des ktops, and networks; applicati on name, v ersion, an d release; switching , router, and gatewa y informat ion; inter connection s and acce ss methods ; and miss ion, busin ess use, o r need | |
302 | Federal re cords of i nformation compiled for law en forcement purposes ( civil, cri minal, or military l aw) | |
303 | Rules of B ehavior | |
304 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Sensiti ve Informa tion | |
305 | I Will: | |
306 | ||
307 | Ensure tha t all prin ted materi al contain ing VA sen sitive inf ormation i s physical ly secured when not in use (e. g., locked cabinet, locked doo r). SOURCE : MP-4 | |
308 | Only provi de access to sensiti ve informa tion to th ose who ha ve a need- to-know fo r their pr ofessional duties, i ncluding o nly postin g sensitiv e informat ion to web based col laboration tools res tricted to those who have a ne ed-to-know and when proper saf eguards ar e in place for sensi tive infor mation. SO URCE: UL-2 | |
309 | Obtain app roval from my superv isor to us e, process , transpor t, transmi t, downloa d, print o r store el ectronic V A sensitiv e informat ion remote ly (outsid e of VA ow ned or man aged facil ities (e.g ., medical centers, community based outp atient cli nics (CBOC ), or regi onal offic es)). SOUR CE: UL-2 | |
310 | Protect VA sensitive informati on from un authorized disclosur e, use, mo dification , or destr uction, an d will use encryptio n products approved and provid ed by VA t o protect sensitive data. SOUR CE: SC-13 | |
311 | Encrypt em ail, inclu ding attac hments, wh ich contai n VA sensi tive infor mation. SO URCE: SC-8 | |
312 | I Will Not : | |
313 | ||
314 | Allow VA s ensitive i nformation to reside on non-VA systems o r devices unless spe cifically designated and autho rized in a dvance by my VA supe rvisor, IS O, and Inf ormation S ystem Owne r, local C IO, or des ignee. SOU RCE: AC-20 | |
315 | Make any u nauthorize d disclosu re of any VA sensiti ve informa tion throu gh any mea ns of comm unication including, but not l imited to, e-mail, i nstant mes saging, on line chat, and web b ulletin bo ards or lo gs. SOURCE : SC-8 | |
316 | Encrypt em ail that d oes not in clude VA s ensitive i nformation or any em ail exclud ed from th e encrypti on require ment. SOUR CE: SC-8 | |
317 | ||
318 | Federal Re cords | |
319 | The Federa l Records Act of 195 0 and late r regulati ons requir e federal agencies t o create a nd maintai n federal records. F ederal rec ords docum ent the bu siness act ivities of the organ ization or agency. T hey are fe deral prop erty and m ust be man aged and m aintained in accorda nce with t he prevail ing law. | |
320 | VA sensiti ve informa tion may b e found in federal r ecords, wh ich have s pecific ha ndling req uirements. Federal r ecords may be kept i n a variet y of forma ts. Federa l records that conta in VA sens itive info rmation mu st be hand led with c are. | |
321 | Each work unit withi n VA must create and maintain a listing of records known as a file pl an or reco rds invent ory. Feder al records must be k ept accord ing to a R ecords Con trol Sche dule (RCS) or Genera l Records Schedule ( GRS). | |
322 | ||
323 | Designated records m anagement officials manage fed eral recor ds across VA adminis trations a nd facilit ies. Work with your locally de signated r ecords man agement of ficial if you are cr eating, tr ansporting , storing, or dispos ing of rec ords to be sure VA s ensitive i nformation is protec ted. | |
324 | Find more informatio n about fe deral reco rds in in Appendix C , Privacy and Inform ation Secu rity Resou rces. | |
325 | Records | |
326 | Records, a s defined by 44 U.S. C., includ es all rec orded info rmation, r egardless of form or character istics, ma de or rece ived by a federal ag ency under federal l aw or in c onnection with the t ransaction of public business and preser ved or app ropriate f or preserv ation by t hat agency or its le gitimate s uccessor a s evidence of the or ganization , function s, policie s, decisio ns, proced ures, oper ations, or other act ivities of the Unite d States G overnment or because of the in formationa l value of data in t hem. It do es not inc lude libra ry and mus eum materi al made or acquired and preser ved solely for refer ence or ex hibition p urposes or duplicate copies of records p reserved o nly for co nvenience. | |
327 | RCS or GRS | |
328 | Federal re cords must be kept a ccording t o an RCS t hat is app roved by t he Nationa l Archives and Recor ds Adminis tration (N ARA). The RCS provid es the ret ention and dispositi on rulings for all s cheduled f ederal rec ords liste d in the R CS. The GR S is a rec ords sched ule that a pplies to all federa l agencies within th e U.S. Gov ernment. T hese inclu de retenti ons and di sposition ruling for common re cords with in the gov ernment. | |
329 | ||
330 | ||
331 | Knowledge Check: Typ es of VA S ensitive I nformation | |
332 | Consider t he followi ng questio n by selec ting the b est answer . | |
333 | Which of t he followi ng VA sens itive info rmation ex amples rep resents PI I? | |
334 | Medical pr ogram qual ity assura nce record s | |
335 | Framework used for s ervers | |
336 | An employe e’s Social Security number | |
337 | A VA compu ter networ k diagram | |
338 | The correc t answer C . An emplo yee’s Soci al Securit y number i s an examp le of PII. Remember to protect all types of VA sen sitive inf ormation. | |
339 | ||
340 | Rules of B ehavior | |
341 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
342 | I Will: | |
343 | ||
344 | Comply wit h all fede ral VA inf ormation s ecurity, p rivacy, an d records management policies. SOURCE: P M-1 | |
345 | Continuous Readiness in Inform ation Secu rity Progr am | |
346 | It is your responsib ility to k eep VA sen sitive inf ormation s afe wherev er you are working. VA’s Conti nuous Read iness in I nformation Security Program (C RISP) high lights wha t to do to protect V A sensitiv e informat ion: | |
347 | Follow all informati on securit y and priv acy polici es and pro cedures an d the ROB | |
348 | View, acce ss, and co llect only the infor mation you need to d o your job | |
349 | Encrypt em ails conta ining VA s ensitive i nformation | |
350 | Do not tal k about VA sensitive informati on in publ ic | |
351 | Do not sha re VA sens itive info rmation wi th anyone who should not have it or does not have a need to know or le gal author ity | |
352 | Rules of B ehavior | |
353 | COVERAGE | |
354 | ||
355 | 1d. VA Inf ormation S ecurity RO B does not supersede any polic ies of VA facilities or other agency com ponents th at provide higher le vels of pr otection t o VA's inf ormation o r informat ion system s. The VA Informatio n Security ROB provi des the mi nimal rule s with whi ch individ ual users must compl y. Authori zed users are requir ed to go b eyond stat ed rules u sing "due diligence" and the h ighest eth ical stand ards. | |
356 | ||
357 | More Infor mation | |
358 | CRISP is a program t hat incorp orates sec urity and privacy in to everyon e’s daily functions and promot es ongoing security and privac y practice s for VA’s environme nt. | |
359 | Passwords | |
360 | To protect your VA-i ssued devi ces and yo ur access to VA sens itive info rmation, f ollow VA’s password requiremen ts. | |
361 | Strong pas swords mee t VA’s min imum passw ord requir ements. We ak passwor ds contain easy-to-g uess infor mation suc h as Passw ord1 or Pa ssword 2, your user name, your first or last name, dictionar y words, o r phrases similar to your prev ious passw ords. | |
362 | VA’s Passw ord Requir ements | |
363 | Your passw ord must h ave at lea st eight c haracters and must i nclude at least thre e of the f ollowing: | |
364 | Capital le tters (A, B, C, etc. ) | |
365 | Lowercase letters (a , b, c, et c.) | |
366 | Numbers (0 –9) | |
367 | Special ch aracters ( such as @, #, $, %) Other guid elines for passwords include: | |
368 | Do not reu se a passw ord that h as been us ed within your last three pass word chang es | |
369 | Change you r password every 90 days or as required | |
370 | Change you r password if you su spect your log-in ha s been com promised | |
371 | If you thi nk your pa ssword has been comp romised, r eport it | |
372 | ||
373 | Rules of B ehavior | |
374 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Identif ication an d Authenti cation | |
375 | I Will: | |
376 | ||
377 | Use passwo rds that m eet the VA minimum r equirement s. SOURCE: IA-5 (1) | |
378 | Protect my passwords ; verify c odes, toke ns, and cr edentials from unaut horized us e and disc losure. SO URCE: IA-5 (h) | |
379 | I Will Not : | |
380 | ||
381 | ||
382 | Store my p asswords o r verify c odes in an y file on any IT sys tem, unles s that fil e has been encrypted using FIP S 140-2 (o r its succ essor) val idated enc ryption, a nd I am th e only per son who ca n decrypt the file. SOURCE: IA -5 (1) (c) | |
383 | Hardcode c redentials into scri pts or pro grams. SOU RCE: IA-5 (1) (c) | |
384 | ||
385 | Personal I dentity Ve rification | |
386 | A Personal Identity Verificati on (PIV) c ard, also known as a PIV badge , is an id entificati on (ID) ca rd that en ables acce ss to VA b uildings, networks, and resour ces. | |
387 | Protect PI V cards fr om loss or theft by following these tips : | |
388 | ||
389 | Always kee p your PIV card with you by at taching it to someth ing on you , such as a lanyard around you r neck | |
390 | Make a hab it of chec king for i t whenever you leave a room | |
391 | Never leav e your PIV card in y our comput er | |
392 | Be extra c areful whe n you are in a publi c place | |
393 | If you los e your PIV card or f ind a lost PIV card, report it to VA sec urity and law enforc ement, the ISO, and your manag ement to e nsure it i s revoked in the sys tem immedi ately | |
394 | VA has ado pted a two -factor au thenticati on approac h to contr ol access to informa tion syste ms. You mu st use you r PIV card for acces s to infor mation and informati on systems unless th ere is a l egitimate exemption. PIV cards comply wi th FIPS 20 1 and rela ted guidan ce. | |
395 | ||
396 | Making the Connectio n: Natalie ’s Story | |
397 | ||
398 | ||
399 | Keeping PI V cards sa fe | |
400 | ||
401 | I went to the VA Med ical Cente r for a ch eckup last week. In the cafete ria, one o f those ba dges the e mployees u se was jus t lying th ere on the lunch tab le. | |
402 | I wondered …could som eone use t hat card t o get at m y personal informati on? Should I be worr ied? | |
403 | Just as I sat down, the employ ee who had left the card | |
404 | came back to pick it up. He to ld me VA h as securit y measures to preven t an intru der from g etting to my informa tion, even if he or she had th at card…th ings like passwords, permissio ns to use networks, and other ways to ma ke sure my informati on is safe . I’m glad to know V A takes my privacy s eriously! | |
405 | Veterans f orm impres sions from the situa tions they witness w here infor mation may be at ris k. Any sit uation can be an opp ortunity t o improve understand ing. | |
406 | ||
407 | What Is Tw o-Factor A uthenticat ion? | |
408 | PIV cards are part o f the two- factor aut henticatio n approach that VA h as adopted to contro l access t o informat ion system s. The fir st element of two-fa ctor authe ntication is somethi ng you hav e, such as your PIV card that can be sca nned for a ccess to V A building s, network s, and res ources. | |
409 | The second element i s somethin g you know , such as your Perso nal Identi fication N umber (PIN ) to acces s informat ion system s. For exa mple, each time you log on to your compu ter, you i nsert a PI V card int o the card reader an d provide your PIN i n order to establish a network connectio n. | |
410 | If a devic e does not have a PI V card rea der, VA of fers the S afeNet Mob ilePASS ap plication for VA Cit rix Access Gateway ( CAG) remot e access, which inst alls a sof tware toke n on the d evice. The device wi th the reg istered to ken become s the some thing you have. | |
411 | Rules of B ehavior | |
412 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
413 | I Will: | |
414 | ||
415 | ||
416 | Follow est ablished p rocedures for reques ting acces s to any V A computer system an d for noti fying my V A supervis or or desi gnee when the access is no lon ger needed . SOURCE: AC-2 | |
417 | Securing P aper and E lectronic Files | |
418 | Secure fil es with VA sensitive informati on when yo u are not using them . Follow t hese guide lines to k eep them s afe: | |
419 | Lock compu ter screen s and VA-i ssued devi ces when y ou are not using the m | |
420 | Keep paper files in locked cab inets or d rawers | |
421 | Follow rec ords manag ement guid ance when handling d ocuments a nd files t hat are re cords | |
422 | Encrypt el ectronic f iles, such as emails with VA s ensitive i nformation , as requi red | |
423 | Do not tra nsmit mess ages or at tachments containing PHI, PII, or VA sen sitive inf ormation t hrough mob ile text m essage or unapproved instant m essaging ( IM) system s | |
424 | If you see or find f iles conta ining VA s ensitive i nformation that are not secure d properly , secure t hem and re port it | |
425 | Rules of B ehavior | |
426 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
427 | I Will: | |
428 | ||
429 | Comply wit h all fede ral VA inf ormation s ecurity, p rivacy, an d records management policies. SOURCE: P M-1 | |
430 | Log out of all infor mation sys tem at the end of ea ch workday . SOURCE: AC-11 | |
431 | Log off or lock any VA compute r or conso le before walking aw ay. SOURCE : AC- 11 | |
432 | Sensitive Informatio n | |
433 | ||
434 | I Will: | |
435 | ||
436 | Ensure tha t all prin ted materi al contain ing VA sen sitive inf ormation i s physical ly secured when not in use (e. g., locked cabinet, locked doo r). SOURCE : MP-4 | |
437 | Encrypt em ail, inclu ding attac hments, wh ich contai n VA sensi tive infor mation. SO URCE: SC-8 | |
438 | ||
439 | I Will Not : | |
440 | ||
441 | Encrypt em ail that d oes not in clude VA s ensitive i nformation or any em ail exclud ed from th e encrypti on require ment. SOUR CE: SC-8 | |
442 | Who Can He lp? | |
443 | You can re ach out to any of th e followin g for help complying with regu lations. | |
444 | ||
445 | Supervisor s | |
446 | Supervisor s are resp onsible fo r protecti ng VA sens itive info rmation an d informat ion system s in the f ollowing w ays: | |
447 | Ensure sta ff underst and IT sec urity and privacy in formation protection issues | |
448 | Ensure sta ff comply with secur ity and pr ivacy regu lations an d policies | |
449 | Ensure sta ff only ha ve access within the scope of their duti es | |
450 | Verify sta ff complet e all priv acy and se curity inf ormation s ecurity tr aining req uirements | |
451 | Ensure sta ff sign th e ROB each year | |
452 | Help staff report id entified p rivacy and informati on securit y incident s | |
453 | ||
454 | Contractin g Officers (COs) or Contractin g Officer Representa tives (COR s) | |
455 | Contractin g Officers (COs) or Contractin g Officer Representa tives (COR s) are res ponsible f or these a ctions to protect VA sensitive informati on and inf ormation s ystems: | |
456 | Ensure con tractors s ign the RO B each yea r if requi red by the contract | |
457 | Maintain t he origina l or a cop y of the s igned ROB (Some CORs may requi re paper c opies in a ddition to the elect ronic ackn owledgment at the en d of this course) | |
458 | Ensure con tractors c omplete re quired pri vacy and i nformation security awareness training b efore they begin the contract and for ea ch year of the contr act | |
459 | Ensure con tractors k now when a nd how to report sec urity and privacy in cidents | |
460 | ||
461 | Privacy Of ficers (PO s) | |
462 | Privacy Of ficers (PO s) have th ese respon sibilities to protec t VA sensi tive infor mation and informati on systems : | |
463 | Promote pr ivacy awar eness | |
464 | Communicat e privacy training r equirement s and dead lines | |
465 | ||
466 | ||
467 | Ensure com pliance wi th federal privacy l aws and re gulations and VA dir ectives, h andbooks, and other guidance | |
468 | Respond to , investig ate, and r eport priv acy incide nts | |
469 | Provide su pport when incidents occur | |
470 | Coordinate and colla borate to ensure tra ining is c ompleted | |
471 | Coordinate with ISOs and Syste m Managers to ensure that data and assoc iated risk s are iden tified and documente d in Priva cy Thresho ld Analysi s (PTA) an d Privacy Impact Ass essment (P IA) submis sions | |
472 | Note: See Appendix D , Privacy and Inform ation Secu rity Resou rces for a link to t he PO Loca tor to ide ntify the PO for you r location . | |
473 | Rules of B ehavior | |
474 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
475 | I Will: | |
476 | ||
477 | Comply wit h all fede ral VA inf ormation s ecurity, p rivacy, an d records management policies. SOURCE: P M-1 | |
478 | Follow est ablished p rocedures for reques ting acces s to any V A computer system an d for noti fying my V A supervis or or desi gnee when the access is no lon ger needed . SOURCE: AC-2 | |
479 | Incident R eporting | |
480 | ||
481 | I Will: | |
482 | ||
483 | Report sus pected or identified informati on securit y incident s includin g anti-vir us, antisp yware, fir ewall or i ntrusion d etection s oftware er rors, or s ignificant alert mes sages (sec urity and privacy) t o my VA su pervisor o r designee immediate ly upon su spicion. S OURCE: IR- 6 | |
484 | Connecting Points | |
485 | Here are t he connect ing points you can r ecall to p rotect VA privacy an d VA sensi tive infor mation: | |
486 | Protect VA sensitive informati on, which includes P HI, PII, a nd regulat ory or pro gram-speci fic inform ation | |
487 | Reach out to your su pervisor, CO, PO, or ISO to he lp you com ply with p olicies an d regulati ons | |
488 | ||
489 | ||
490 | Follow the ROB to pr otect priv acy and en sure secur ity of VA sensitive informatio n and info rmation sy stems | |
491 | ||
492 | ||
493 | Module 3. Risks in t he Digital Age | |
494 | Objectives | |
495 | Technologi es in the digital ag e make dai ly tasks e asier to a ccomplish by making it easy fo r everyone to connec t and comm unicate fa ster. VA k eeps up wi th these t rends and technologi es to serv e Veterans and their families efficientl y and effe ctively. B ut with th e benefits come the risks. VA takes step s to ensur e informat ion is sec ure from c yberattack s and thef t. You can do your p art by fol lowing the ROB. | |
496 | When you h ave comple ted this t opic, you will be ab le to: | |
497 | ||
498 | Recall how to safegu ard electr onic VA se nsitive in formation | |
499 | Identify h ow popular technolog ies and ap plications can expos e VA sensi tive infor mation | |
500 | Texting | |
501 | Text messa ging has b ecome a co nvenient w ay to comm unicate, a nd you may use text messaging on your VA -issued mo bile devic es just as you would use email for VA bu siness. Ho wever, the re are som e risks to text mess aging: | |
502 | There is n o guarante e that an intended r ecipient i s in posse ssion of h is or her mobile dev ice | |
503 | Text messa ges appear in plain text and c an easily be viewed by anyone nearby | |
504 | Text messa ges are st ored on th e device u ntil they are delete d | |
505 | Mobile car riers have data rete ntion poli cies that include te xt message s | |
506 | ||
507 | Remember t hat you ar e not allo wed to use your text messaging on your p ersonal de vices for VA busines s. | |
508 | More Infor mation | |
509 | If you do use text m essaging o n your VA- issued dev ice for VA business, consider the follow ing tips: | |
510 | Never send or share PHI, PII, or any oth er VA sens itive info rmation in a text me ssage | |
511 | Be aware o f your sur roundings or go to a private a rea when t exting | |
512 | Be aware t hat VA bus iness-rela ted text m essages ma y be recor ds and exe rcise caut ion before deleting them | |
513 | Use a more secure fo rm of comm unication for sensit ive matter s | |
514 | ||
515 | ||
516 | Electronic Data Prot ection | |
517 | ||
518 | I Will Not : | |
519 | ||
520 | Transmit V A sensitiv e informat ion via wi reless tec hnologies unless the connectio n uses FIP S 140-2 (o r its succ essor) val idated enc ryption. S OURCE: AC- 18 | |
521 | Sensitive Informatio n | |
522 | ||
523 | I Will Not : | |
524 | ||
525 | Allow VA s ensitive i nformation to reside on non-VA systems o r devices unless spe cifically designated and autho rized in a dvance by my VA supe rvisor, IS O, and Inf ormation S ystem Owne r, local C IO, or des ignee. SOU RCE: AC-20 | |
526 | Instant Me ssaging (I M) | |
527 | VA has an approved I M system t o exchange informati on securel y on its n etworks. T his instan t message (IM) syste m lets you communica te securel y with oth ers on the VA networ k. If you use IM reg ularly for VA busine ss, be awa re: | |
528 | Transmissi on of mess ages is en crypted, b ut actual messages a re not enc rypted on the comput er screen | |
529 | IM convers ations are often sav ed by defa ult and un encrypted in Microso ft® Outloo k's® Conve rsation Hi story | |
530 | More Infor mation | |
531 | Consider t hese tips to protect VA sensit ive inform ation when using IM: | |
532 | ||
533 | Close the IM window when a con versation ends so no passerby can view i t on your screen | |
534 | If you hav e access t o settings , turn off the conve rsation-sa ving featu re in Outl ook (somet imes indiv iduals hav e this cap ability; s ometimes i t is contr olled by y our IT dep artment) | |
535 | Never cond uct VA bus iness usin g instant message fe atures of personally owned dev ices | |
536 | Never incl ude PHI, P II, or oth er VA sens itive info rmation in non-appro ved IM sys tems | |
537 | ||
538 | ||
539 | Sensitive Informatio n | |
540 | ||
541 | I Will Not : | |
542 | ||
543 | Allow VA s ensitive i nformation to reside on non-VA systems o r devices unless spe cifically designated and autho rized in a dvance by my VA supe rvisor, IS O, and Inf ormation S ystem Owne r, local C IO, or des ignee. SOU RCE: AC-20 | |
544 | Make any u nauthorize d disclosu re of any VA sensiti ve informa tion throu gh any mea ns of comm unication including, but not l imited to, e-mail, i nstant mes saging, on line chat, and web b ulletin bo ards or lo gs. SOURCE : SC-8 | |
545 | ||
546 | Interactiv e Exercise #1: Sendi ng IMs Sec urely | |
547 | It’s time for an int eractive e xercise. S elect the correct an swer for e ach of the questions based on the inform ation prov ided. | |
548 | Exercise # 1: Scenari o | |
549 | ||
550 | Sarah has been worki ng closely with a Ve teran to | |
551 | help him u nderstand his benefi ts. She ne eds to fol low up wit h her coll eague, Jer ry, and kn ows he alw ays answer s immediat ely over V A’s approv ed IM. | |
552 | An instant message ( from VA IM ) from Sar ah to Jerr y. Sarah: “Hey, Jame s B. is cu rrently in my office to discus s his disa bility ben efits. Can you pleas e forward the forms for his re quest? His SSN is 12 3-45-6789. ” | |
553 | Exercise # 1: Questio n | |
554 | Is it acce ptable to send the i nstant mes sage with the Vetera n’s name a nd SSN ove r VA’s ins tant messa ging syste m? | |
555 | Yes | |
556 | No | |
557 | ||
558 | The correc t answer i s Yes. She can send this insta nt message with PII from her V A desktop to Jerry’s VA deskto p. Transmi ssion of m essages is encrypted ; however, actual me ssages are not encry pted on th e computer screen, s o she need s to be aw are that t he message s appear i n plain te xt and can easily be viewed by anyone ne arby. | |
559 | ||
560 | ||
561 | Interactiv e Exercise #2: Sendi ng IMs Sec urely | |
562 | Select the correct a nswer for each of th e question s based on the infor mation pro vided. | |
563 | Exercise # 2: Scenari o | |
564 | An instant message ( from VA IM ) from Jer ry to Sara with an a ttachment. IM text r eads “Here is the Di sability R equest For m for Jame s B.” | |
565 | Exercise # 2: Questio n | |
566 | Sarah rece ives a res ponse from Jerry wit h an attac hed docume nt. Is Jer ry violati ng policy by attachi ng the doc ument with in VA’s in stant mess aging syst em? | |
567 | Yes | |
568 | No | |
569 | ||
570 | The correc t answer i s No. He i s not viol ating the policy. VA ’s approve d IM syste m transmit s encrypte d messages ; however, actual me ssages are not encry pted on th e computer screen. | |
571 | ||
572 | ||
573 | Interactiv e Exercise #3: Sendi ng IMs Sec urely | |
574 | ||
575 | Exercise # 3: Scenari o | |
576 | Instant me ssages (fr om VA IM) between Je rry and Sa ra with an attachmen t and Conv ersation S aved at th e bottom. | |
577 | Sarah and James are finished m eeting, an d she rece ived the f orm that t hey needed . Sarah ha s another appointmen t immediat ely after James leav es and wil l need to continue w orking on his reques t later in the day. | |
578 | ||
579 | Exercise # 3: Questio n | |
580 | Is it appr opriate fo r Sarah to leave the screen op en while h er next ap pointment takes plac e? | |
581 | Yes | |
582 | No | |
583 | ||
584 | The correc t answer i s No. It v iolates po licy to ke ep the IM window ope n. She mus t close th e IM windo w when a c onversatio n ends so no passerb y can view it on the screen. T his could possibly p ose a risk for expos ing VA sen sitive inf ormation. | |
585 | ||
586 | Social Med ia | |
587 | Social med ia tools a re popular ways to c onnect wit h others. VA allows the use of certain s ocial medi a and othe r web-base d collabor ation tool s to work together a nd share b usiness in formation. | |
588 | These incl ude: | |
589 | ||
590 | ||
591 | ||
592 | Flickr | |
593 | Google+ | |
594 | ||
595 | VAntage Po int | |
596 | YouTube | |
597 | VA Pulse | |
598 | ||
599 | Keep in mi nd, howeve r, that ea ch program office an d facility site may have its o wn rules f or access and use. I f you are unsure abo ut access to specifi c social m edia sites , contact your super visor. Acc essing sit es and too ls on the Internet m ay expose VA to secu rity and p rivacy thr eats. | |
600 | ||
601 | Risks of U sing Socia l Media | |
602 | Here are s ome risks of using s ocial medi a: | |
603 | ||
604 | Informatio n is not p rivate in an online forum | |
605 | Posting ph otos and t ext may re veal VA se nsitive in formation | |
606 | Web pages and online postings may contai n maliciou s codes, l inks, and attachment s | |
607 | Establishi ng an onli ne presenc e makes yo u a target for hacke rs and a s ource for phishing | |
608 | Rules of B ehavior | |
609 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Sensiti ve Informa tion | |
610 | I Will: | |
611 | ||
612 | Only provi de access to sensiti ve informa tion to th ose who ha ve a need- to-know fo r their pr ofessional duties, i ncluding o nly postin g sensitiv e informat ion to web based col laboration tools res tricted to those who have a ne ed-to-know and when proper saf eguards ar e in place for sensi tive infor mation. SO URCE: UL-2 | |
613 | I Will Not : | |
614 | ||
615 | Allow VA s ensitive i nformation to reside on non-VA systems o r devices unless spe cifically designated and autho rized in a dvance by my VA supe rvisor, IS O, and Inf ormation S ystem Owne r, local C IO, or des ignee. SOU RCE: AC-20 | |
616 | Make any u nauthorize d disclosu re of any VA sensiti ve informa tion throu gh any mea ns of comm unication including, but not l imited to, e-mail, i nstant mes saging, on line chat, and web b ulletin bo ards or lo gs. SOURCE : SC-8 | |
617 | More Infor mation | |
618 | If you use approved social med ia regular ly for VA business, keep these guideline s in mind to keep VA and Veter ans safe: | |
619 | Never comm ent on VA legal matt ers, unles s you are an officia l spokespe rson and h ave approv al to do s o | |
620 | Never post or share PHI, PII, SPI, VA se nsitive in formation, or VA bus iness info rmation in any socia l media fo rum | |
621 | Never cond uct VA bus iness thro ugh social media pri vate messa ging serve rs | |
622 | Never stor e VA sensi tive infor mation on file-shari ng sites | |
623 | Never clic k on links or open a ttachments posted on social me dia | |
624 | ||
625 | ||
626 | Never shar e account or access credential s | |
627 | Be aware t hat detail s you reve al in phot os and tex t postings may viola te others’ privacy | |
628 | When using public so cial media sites for personal use, remai n as anony mous as po ssible by not reveal ing too mu ch persona l informat ion, emplo yment info rmation, o r organiza tional aff iliations in online postings a nd profile s | |
629 | ||
630 | Knowledge Check: Usi ng Social Media to C onduct Bus iness | |
631 | Consider t he followi ng questio n by selec ting the b est answer . | |
632 | Which of t he followi ng example s of socia l media si tes can be used with in VA to c ollaborate and share VA busine ss informa tion secur ely? | |
633 | Facebook, Snapchat, and Google + | |
634 | Facebook, VA Pulse, and Instag ram | |
635 | Tumblr, Fl ickr, and Pinterest | |
636 | YouTube, V ine, Pinte rest | |
637 | The correc t answer i s B. Faceb ook, VA Pu lse, and I nstagram. VA allows the use of certain s ocial medi a and othe r web-base d collabor ation tool s to work together a nd share b usiness in formation. Do not sh are VA sen sitive inf ormation o n social m edia sites . | |
638 | ||
639 | Hacking | |
640 | Hacking re fers to br eaking int o a system without a uthorizati on or inte ntionally violating the terms or restric tions of a ccessing a system fo r which an individua l has been given acc ess. Hacki ng may ori ginate fro m within o r outside VA network s and faci lities. | |
641 | Examples o f internal hacking i nclude ins talling un authorized software to steal V A sensitiv e informat ion and by passing ne twork secu rity contr ols withou t authoriz ation. | |
642 | Hacking at tacks may have a wid e range of direct an d indirect impacts f or VA, inc luding: | |
643 | ||
644 | Compromise d security and netwo rks (which could lea d to more cyberattac ks) | |
645 | Data breac hes | |
646 | Compromise d accounts and infor mation | |
647 | Identity t heft | |
648 | Lost time and money | |
649 | Loss of tr ust in VA | |
650 | ||
651 | More Infor mation | |
652 | Following the ROB is the right step for protecting VA from h acking att empts. Ext ernal sour ces of hac king inclu de social engineerin g attempts to steal log-in cre dentials a nd stealin g personal informati on through phishing emails. He re are oth er things you can do : | |
653 | Use approv ed devices , software , informat ion, and s ystems onl y for the intended p urposes | |
654 | Report sus picious ac tivities | |
655 | Never acce ss systems that you are not au thorized t o access | |
656 | Never bypa ss or expl oit securi ty and con trols of V A systems and device s | |
657 | Never down load or in stall soft ware on yo ur VA devi ces withou t approval | |
658 | Never let unauthoriz ed individ uals acces s VA sensi tive infor mation, VA -issued de vices, or VA systems | |
659 | Rules of B ehavior | |
660 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
661 | I Will: | |
662 | ||
663 | Log off or lock any VA compute r or conso le before walking aw ay. SOURCE : AC- 11 | |
664 | I Will Not : | |
665 | ||
666 | Attempt to probe com puter syst ems to exp loit syste m controls or to obt ain unauth orized acc ess to VA sensitive data. SOUR CE: AC-6 | |
667 | Engage in any activi ty that is prohibite d by VA Di rective 60 01, Limite d Personal Use of Go vernment O ffice Equi pment Incl uding Info rmation Te chnology. SOURCE: AC -8 | |
668 | Host, set up, admini ster, or o perate any type of I nternet se rver or wi reless acc ess point on any VA network un less expli citly auth orized by my Informa tion Syste m Owner, l ocal CIO, or designe e and appr oved by my ISO. SOUR CE: AC-18 | |
669 | Electronic Data Prot ection | |
670 | ||
671 | I Will: | |
672 | ||
673 | Only use v irus prote ction soft ware, anti -spyware, and firewa ll/intrusi on detecti on softwar e authoriz ed by VA. SOURCE: Sl -3 | |
674 | ||
675 | ||
676 | Safeguard VA mobile devices an d portable storage d evices con taining VA informati on, at wor k and remo tely, usin g FIPS 140 -2 validat ed encrypt ion (or it s successo r) unless it is not technicall y possible . This inc ludes lapt ops, flash drives, a nd other r emovable s torage dev ices and s torage med ia (e.g., Compact Di scs (CD), Digital Vi deo Discs (DVD)). SO URCE: SC-1 3 | |
677 | Only use d evices enc rypted wit h FIPS 140 -2 (or its successor ) validate d encrypti on. VA own ed and app roved stor age device s/media mu st use VA' s approved configura tion and s ecurity co ntrol requ irements. SOURCE: SC -28 | |
678 | I Will Not : | |
679 | ||
680 | Disable or degrade s oftware pr ograms use d by VA th at install security software u pdates to VA compute r equipmen t, to comp uter equip ment used to connect to VA inf ormation s ystems, or used to c reate, sto re or use VA informa tion. SOUR CE: CM-10 | |
681 | Teleworkin g and Remo te Access | |
682 | ||
683 | I Will: | |
684 | ||
685 | Protect GF E from the ft, loss, destructio n, misuse, and emerg ing threat s. SOURCE: AC-17 | |
686 | Social Eng ineering | |
687 | One way a hacker mig ht try to gain acces s to VA ne tworks is through so cial engin eering. So cial engin eering is an attempt to trick someone in to disclos ing VA sen sitive inf ormation, performing unauthori zed action s on VA eq uipment an d devices, or provid ing unauth orized acc ess to VA systems, n etworks, o r faciliti es. These attempts m ay come in the form of a face- to-face co nversation , regular mail, emai l, or even IM or tex t message. | |
688 | Follow the se tips to deal with social en gineering attacks: | |
689 | ||
690 | Protect PH I, PII, an d VA sensi tive infor mation | |
691 | If you are unsure of someone's credentia ls, exerci se due dil igence to verify the m | |
692 | If someone asks you to perform an unauth orized act ion on a V A-issued d evice, ver ify with t he authori zing autho rity | |
693 | Report sus picious ac tivities | |
694 | Never shar e log-in o r access i nformation to any ac counts, ne tworks, or systems | |
695 | Never allo w individu als into a reas where they are not author ized to en ter | |
696 | ||
697 | More Infor mation | |
698 | Examples o f social e ngineering attacks m ay be: | |
699 | ||
700 | Someone cl aims to be from the help desk and wants to run upd ates on yo ur VA- iss ued laptop . | |
701 | A caller w ho is unab le to veri fy any inf ormation s ays he is a Veteran who has lo st his My HealtheVet log-in cr edentials. | |
702 | An email a pparently from the I nspector G eneral ask s you to v erify your log-in pa ssword for VA Pulse by replyin g with the informati on. | |
703 | Over lunch , a cowork er from a different department says she is a close friend of a Veteran who has j ust been a dmitted to the medic al center and wants to know wh at informa tion you h ave about him. | |
704 | Rules of B ehavior | |
705 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Telewor king and R emote Acce ss | |
706 | I Will: | |
707 | ||
708 | Protect in formation about remo te access mechanisms from unau thorized u se and dis closure. S OURCE: AC- 17 | |
709 | User Accou ntability | |
710 | ||
711 | I Will: | |
712 | ||
713 | Permit onl y those au thorized b y Ol&T to perform ma intenance on IT comp onents, in cluding in stallation or remova l of hardw are or sof tware. SOU RCE: MA-5 | |
714 | Identifica tion and A uthenticat ion | |
715 | ||
716 | I Will: | |
717 | ||
718 | Protect my passwords ; verify c odes, toke ns, and cr edentials from unaut horized us e and disc losure. SO URCE: IA-5 (h) | |
719 | Phishing | |
720 | Phishing i s a specif ic type of social en gineering that uses email, tex t message, or IM to trick a pe rson into revealing Sensitive Personal I nformation . In a phi shing scam , a messag e appears to be from a trusted individua l or organ ization th at directs the victi m to open an attachm ent or a l ink to a w ebsite. Th e attachme nt or link malicious ly install s software to steal informatio n or opens a website that requ ests accou nt numbers , | |
721 | ||
722 | usernames and passwo rds, or ot her person al data an d informat ion. In a recent int ernal VA s urvey, 30% of respon dents did not recogn ize phishi ng threats . | |
723 | Here’s how to protec t yourself from phis hing attac ks: | |
724 | ||
725 | Notice any details i n the emai l or link that might indicate it is a ph ishing sca m, such as misspelli ngs, typos , or links that are similar bu t are not the organi zation's w ebsite | |
726 | Never open a link or attachmen t from som eone you d o not know | |
727 | Be cautiou s with ema ils from u nknown sen ders and o utside of VA that ha ve “[EXTER NAL]” appe nded to th e subject line | |
728 | If you are unsure ab out a link or attach ment from someone yo u do know, confirm w ith the se nder | |
729 | Report sus picious ac tivities t o your sup ervisor, I SO, or PO | |
730 | ||
731 | For more i nformation or questi ons, conta ct Nationa l Security Operation s Center ( NSOC) thro ugh the VA National Service De sk. | |
732 | ||
733 | Knowledge Check: Phi shing | |
734 | Consider t he followi ng questio n by selec ting the b est answer . | |
735 | Which of t he followi ng example s represen ts a possi ble phishi ng attack? | |
736 | ||
737 | An email f rom an unk nown sende r contains only a li nk or atta chment wit hout a mes sage | |
738 | A VA emplo yee bypass ing securi ty control s on a VA device | |
739 | Someone ca lling to r equest you r log-in a nd passwor d to acces s the VA n etwork | |
740 | Someone en tering the building without an official identifica tion badge | |
741 | ||
742 | The correc t answer i s A. Phish ing is a s pecific ty pe of soci al enginee ring that uses email , text mes sage, or I M to trick a person into revea ling Sensi tive Perso nal Inform ation. An email from an unknow n sender c ontaining only a lin k or attac hment with out a mess age is an example of a possibl e phishing attempt. | |
743 | ||
744 | Making the Connectio n: Mr. and Mrs. Sala zar’s Stor y | |
745 | ||
746 | ||
747 | More Than a Number | |
748 | My husband and I are both Vete rans. We g et nervous when we h ear a stor y on the n ews about businesses or federa l agencies that have had data stolen by a hacker. | |
749 | We wonder what VA is doing to make sure that doesn ’t happen to us. | |
750 | I decided to call VA and ask h ow I can p rotect my VA informa tion and w hat would happen if my VA sens itive info rmation is stolen. I learned t hat VA’s M ore Than a Number id entity pro tection pr ogram is a resource for ways t o protect our family and keep our identi ties safe. | |
751 | Sometimes news stori es cause V eterans to worry abo ut VA’s se curity pra ctices. Id entity the ft is a co mmon conce rn. | |
752 | ||
753 | Identity T heft | |
754 | Identity t heft is a crime in w hich someo ne obtains and uses someone el se's perso nal inform ation for fraud or d eception. VA informa tion and n etworks ar e a gold m ine for ha ckers and identity t hieves. Fo rtunately, VA is com mitted to protecting Veterans and their families f rom identi ty theft. VA relies on you to do your pa rt by foll owing secu rity and p rivacy gui delines. | |
755 | Follow the ROB to pr otect PHI, PII, and VA sensiti ve informa tion | |
756 | Handle, tr ansmit, st ore, and d ispose of SPI and VA sensitive informati on accordi ng to VA p olicies an d procedur es | |
757 | Never shar e log-in o r access i nformation for any a ccounts, n etworks, o r systems | |
758 | Never allo w an unaut horized pe rson to ac cess your VA-issued devices | |
759 | Report any suspiciou s activiti es | |
760 | ||
761 | What to Do if You or Someone Y ou Know Is a Victim | |
762 | Chances ar e you know someone w ho has had his or he r identity stolen. H ere are st eps from t he VA Offi ce of Info rmation Se curity tha t you can take if yo u or someo ne you kno w might be a victim of identit y theft: | |
763 | Contact th e VA Ident ity Theft Help Line (see the R esources s ection for informati on) | |
764 | ||
765 | ||
766 | File a com plaint wit h the Fede ral Trade Commission (FTC) | |
767 | Place a fr aud alert on your cr edit repor t | |
768 | Order a co py of your credit re port | |
769 | Contact yo ur banks a nd financi al institu tions | |
770 | Report it to the pol ice and ke ep a copy of the rep ort on han d | |
771 | ||
772 | Rules of B ehavior | |
773 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
774 | I Will: | |
775 | ||
776 | Comply wit h all fede ral VA inf ormation s ecurity, p rivacy, an d records management policies. SOURCE: P M-1 | |
777 | Electronic Data Prot ection | |
778 | ||
779 | I Will: | |
780 | ||
781 | Safeguard VA mobile devices an d portable storage d evices con taining VA informati on, at wor k and remo tely, usin g FIPS 140 -2 validat ed encrypt ion (or it s successo r) unless it is not technicall y possible . This inc ludes lapt ops, flash drives, a nd other r emovable s torage dev ices and s torage med ia (e.g., Compact Di scs (CD), Digital Vi deo Discs (DVD)). SO URCE: SC-1 3 | |
782 | Only use d evices enc rypted wit h FIPS 140 -2 (or its successor ) validate d encrypti on. VA own ed and app roved stor age device s/media mu st use VA' s approved configura tion and s ecurity co ntrol requ irements. SOURCE: SC -28 | |
783 | Sensitive Informatio n | |
784 | ||
785 | I Will: | |
786 | ||
787 | Only provi de access to sensiti ve informa tion to th ose who ha ve a need- to-know fo r their pr ofessional duties, i ncluding o nly postin g sensitiv e informat ion to web - based co llaboratio n tools re stricted t o those wh o have a n eed-to-kno w and when proper sa feguards a re in plac e for sens itive info rmation. S OURCE: UL- 2 | |
788 | Protect VA sensitive informati on from un authorized disclosur e, use, mo dification , or destr uction, an d will use encryptio n products approved and provid ed by VA t o protect sensitive data. SOUR CE: SC-13 | |
789 | Connecting Points | |
790 | Here are s ome connec ting point s to recal l when usi ng popular technolog ies: | |
791 | ||
792 | ||
793 | Always pro tect PHI, PII, and V A sensitiv e informat ion | |
794 | Use text m essaging a nd IM secu rely | |
795 | Never tran smit PHI, PII, or an y other VA sensitive informati on over te xt messagi ng or unap proved IM systems | |
796 | Be aware o f what you post and reveal on social med ia | |
797 | Follow VA policies a nd procedu res to pre vent hacki ng and oth er cyberat tacks | |
798 | Watch out for phishi ng attacks disguised as ordina ry emails and messag es | |
799 | Take preca utions to protect yo urself and Veterans from ident ity theft | |
800 | ||
801 | ||
802 | Module 4: Using Syst ems Secure ly | |
803 | Objectives | |
804 | VA depends on you to keep syst ems and ne tworks sec ure. Follo w VA polic ies and us e only app roved conn ections wh en you acc ess VA inf ormation s ystems. | |
805 | When you h ave comple ted this t opic, you will be ab le to: | |
806 | ||
807 | Recall how to secure ly access VA systems | |
808 | Identify t hreats to VA network s | |
809 | ||
810 | VA Network s | |
811 | You have a ccess to m any resour ces on VA networks. But with t hat access comes the responsib ility to k eep VA’s n etworks an d systems safe and s ecure. | |
812 | Here are t hings you must do to be secure when you access VA’ s networks : | |
813 | ||
814 | Only acces s networks and syste ms that yo u are allo wed to acc ess | |
815 | Do not hav e an open VA network connectio n and an o pen non-VA network c onnection connected to your co mputer or device at the same t ime unless authorize d | |
816 | Never disa ble any VA network s ecurity co ntrols | |
817 | Report any suspiciou s activiti es | |
818 | ||
819 | Rules of B ehavior | |
820 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
821 | I Will: | |
822 | ||
823 | Use only V A-approved devices, systems, s oftware, s ervices, a nd data wh ich I am a uthorized to use, in cluding co mplying wi th any sof tware lice nsing or c opyright r estriction s. SOURCE: AC-6 | |
824 | Only use V A-approved solutions for conne cting non- VA-owned s ystems to VA's netwo rk. SOURCE : AC-20 | |
825 | I Will Not : | |
826 | ||
827 | Have a VA network co nnection a nd a non-V A network connection (includin g a modem or phone l ine or wir eless netw ork card, etc.) phys ically con nected to any | |
828 | ||
829 | device at the same t ime unless the dual connection is explic itly autho rized. SOU RCE: AC-17 (k) | |
830 | Protection of Comput ing Resour ces | |
831 | ||
832 | I Will Not : | |
833 | ||
834 | Attempt to override, circumven t, alter o r disable operationa l, technic al, or man agement se curity con figuration controls unless exp ressly dir ected to d o so by au thorized V A staff. S OURCE: CM- 3 | |
835 | Electronic Data Prot ection | |
836 | ||
837 | I Will: | |
838 | ||
839 | Only use v irus prote ction soft ware, anti -spyware, and firewa ll/intrusi on detecti on softwar e authoriz ed by VA. SOURCE: Sl -3 | |
840 | Teleworkin g and Remo te Access | |
841 | ||
842 | I Will: | |
843 | ||
844 | Obtain app roval prio r to using remote ac cess capab ilities to connect n on-GFE equ ipment to VA's netwo rk while w ithin the VA facilit y. SOURCE: AC-17 | |
845 | Wireless N etworks | |
846 | When you c onnect to VA's netwo rks, use a hardwired connectio n if possi ble. Conne cting by W i-Fi (wire less acces s) puts VA at risk. If you mus t use a wi reless con nection, u se VA-appr oved remot e access a nd VA-appr oved wirel ess device s. | |
847 | Remember t he rules w hen access ing from a wireless connection : | |
848 | ||
849 | When you u se a secur e, passwor d-protecte d public I nternet co nnection, use VA’s r emote acce ss technol ogies to a ccess any VA resourc es | |
850 | Never acce ss nonpubl ic VA reso urces from public co mputers or devices, such as a public com puter at a library o r a tablet displayed in a reta il store | |
851 | Never brin g your per sonally ow ned equipm ent into a VA facili ty and con nect to th e network | |
852 | If you hav e been app roved to u se a perso nal device for VA bu siness, yo u may only use VA-ap proved rem ote access technolog ies, such as CAG, to access VA resources | |
853 | Rules of B ehavior | |
854 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R | |
855 | ||
856 | Access and Use of VA Informati on Systems | |
857 | ||
858 | I Will: | |
859 | ||
860 | Use only V A-approved devices, systems, s oftware, s ervices, a nd data wh ich I am a uthorized to use, in cluding co mplying wi th any sof tware lice nsing or c opyright r estriction s. SOURCE: AC-6 | |
861 | Only use V A-approved solutions for conne cting non- VA-owned s ystems to VA's netwo rk. SOURCE : AC-20 | |
862 | Electronic Data Prot ection | |
863 | ||
864 | I Will: | |
865 | ||
866 | Only use d evices enc rypted wit h FIPS 140 -2 (or its successor ) validate d encrypti on. VA own ed and app roved stor age device s/media mu st use VA' s approved configura tion and s ecurity co ntrol requ irements. SOURCE: SC -28 | |
867 | I Will Not : | |
868 | ||
869 | Transmit V A sensitiv e informat ion via wi reless tec hnologies unless the connectio n uses FIP S 140-2 (o r its succ essor) val idated enc ryption. S OURCE: AC- 18 | |
870 | Teleworkin g and Remo te Access | |
871 | ||
872 | I Will Not : | |
873 | ||
874 | Access non -public VA informati on technol ogy resour ces from p ublicly-av ailable IT computers , such as remotely c onnecting to the int ernal VA n etwork fro m computer s in a pub lic librar y. SOURCE: AC-17 | |
875 | Remote Acc ess | |
876 | Use VA-app roved remo te access methods to access VA resources whenever you are co nnecting f rom outsid e of a VA facility. In most ca ses, a tel ework agre ement is n ecessary t o regularl y access V A systems remotely. Contact yo ur ISO for informati on on how to get a r emote acce ss account . | |
877 | You must f ollow VA’s national and local security p olicies, p rocedures, and confi guration s tandards b efore bein g allowed access to any VA net work. | |
878 | Being gran ted remote access ca pabilities means you must: | |
879 | ||
880 | Have appro val from y our superv isor to wo rk from ho me and, if required, a signed telework a greement | |
881 | ||
882 | ||
883 | Connect th rough the Citrix Acc ess Gatewa y (CAG) wi th two-fac tor authen tication t hrough req uired use of a PIV c ard reader or SafeNe t MobilePA SS token | |
884 | Never cond uct VA bus iness thro ugh your p ersonal em ails, pers onal IMs, or persona l phone te xt message s | |
885 | Let your s upervisor and ISO kn ow when yo u no longe r need rem ote access | |
886 | ||
887 | More Infor mation | |
888 | Citrix Acc ess Gatewa y (CAG) | |
889 | ||
890 | CAG is the only VA-a pproved me thod to co nnect remo tely for n on-VA devi ces, such as persona l devices or those d evices use d by contr actors. Yo u can also use CAG f or remote access fro m a VA-fur nished dev ice. | |
891 | Remote Ent erprise Se curity Com pliance Up date Envir onment (RE SCUE) | |
892 | ||
893 | RESCUE pro vides Virt ual Privat e Network (VPN) acce ss on VA-f urnished d evices. If VA has is sued you a laptop co mputer, yo u can use RESCUE to access VA’ s network when you a re not con nected dir ectly with in a VA fa cility. | |
894 | Two-Factor Authentic ation | |
895 | ||
896 | Two-factor authentic ation veri fies your identity w ith two el ements: so mething yo u have, su ch as your PIV card, and somet hing you k now, a PIN . If a dev ice does n ot have a card reade r, VA offe rs the Saf eNet Mobil ePASS appl ication fo r VA CAG r emote acce ss, which installs a software token on t he device. | |
897 | Rules of B ehavior | |
898 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
899 | I Will: | |
900 | ||
901 | Follow est ablished p rocedures for reques ting acces s to any V A computer system an d for noti fying my V A supervis or or desi gnee when the access is no lon ger needed . SOURCE: AC-2 | |
902 | Teleworkin g and Remo te Access | |
903 | ||
904 | I Will: | |
905 | ||
906 | Safeguard VA sensiti ve informa tion, in a ny format, device, s ystem and/ or softwar e in remot e location s (e.g., a t home and during tr avel). SOU RCE: AC-17 | |
907 | ||
908 | ||
909 | Provide au thorized O l&T person nel access to inspec t the remo te locatio n pursuant to an app roved tele work agree ment that includes a ccess to V A sensitiv e informat ion. SOURC E: AC-17 | |
910 | Protect in formation about remo te access mechanisms from unau thorized u se and dis closure. S OURCE: AC- 17 | |
911 | I Will Not : | |
912 | ||
913 | Access non -public VA informati on technol ogy resour ces from p ublicly-av ailable IT computers , such as remotely c onnecting to the int ernal VA n etwork fro m computer s in a pub lic librar y. SOURCE: AC-17 | |
914 | Sensitive Informatio n | |
915 | ||
916 | I Will: | |
917 | ||
918 | Only provi de access to sensiti ve informa tion to th ose who ha ve a need- to-know fo r their pr ofessional duties, i ncluding o nly postin g sensitiv e informat ion to web - based co llaboratio n tools re stricted t o those wh o have a n eed-to-kno w and when proper sa feguards a re in plac e for sens itive info rmation. S OURCE: UL- 2 | |
919 | Network Ac cess While Traveling Outside t he United States | |
920 | The risk o f exposing VA networ ks to unau thorized p arties can be greate r when tra veling out side the U nited Stat es. You ma y access V A external web appli cations wh ile travel ing, but c ertain oth er access is prohibi ted. Be su re to cont act your V A supervis or, ISO, P O, or loca l Chief In formation Officer (C IO) if you plan to t ravel outs ide the U. S. and if you expect to have a need to a ccess VA n etworks wh ile travel ing. | |
921 | You are no t allowed to access VA interna l networks when you are travel ing to cou ntries tha t pose a s ignificant security risk, unle ss you hav e specific authoriza tion from your VA su pervisor, ISO, local CIO, and Informatio n System O wner. Thes e countrie s include non-NATO c ountries a nd other h igh risk c ountries a s identifi ed by VA o r the Stat e Departme nt. | |
922 | Rules of B ehavior | |
923 | INFORMATIO N SECURITY RULES of BEHAVIOR Telework a nd Remote Access | |
924 | ||
925 | ||
926 | Exercise a higher le vel of awa reness in protecting GFE mobil e devices when trave ling inter nationally as laws a nd individ ual rights vary by c ountry and threats a gainst Fed eral emplo yee device s may be h eightened. SOURCE: A C-19 | |
927 | Notify my VA supervi sor or des ignee prio r to any i nternation al travel with a GFE mobile de vice (e.g. laptop, P DA) and up on return, including potential ly issuing a specifi cally conf igured dev ice for in ternationa l travel a nd/or insp ecting the device or reimaging the hard drive upon return. S OURCE: AC- 17 | |
928 | Telework G uidance | |
929 | Teleworkin g, or tele commuting, refers to a work fl exibility arrangemen t under wh ich you do not commu te to a ce ntral plac e of work every day. If you ar e approved to teleco mmute, you may work from anoth er approve d worksite , such as a home off ice or ano ther facil ity. Keep in mind th at you may need a si gned telew ork agreem ent to tel ework. Som e software tools use d when wor king remot ely includ e: | |
930 | VA-approve d remote a ccess | |
931 | Conference calling | |
932 | Video conf erencing | |
933 | ||
934 | Use all te leworking tools secu rely to pr otect VA s ensitive i nformation . | |
935 | ||
936 | VA’s Telew ork Policy | |
937 | VA’s telew ork policy is locate d in VA Ha ndbook 501 1/26, Hour s of Duty and Leave (Telework) and is al so known a s the Alte rnative Wo rkplace Ar rangement policy. Re view the h andbook fo r informat ion on the VA telewo rk program and telew ork criter ia as well as exampl es of the forms to r equest per mission. | |
938 | VA Form 07 40 is used to establ ish a tele work agree ment. This document includes t he request to telewo rk, the em ployee’s w orkplace a rrangement s and work schedule, and infor mation abo ut equipme nt used to telework. If you ar e eligible for telew ork, you m ust first complete t he VA Tele work Train ing Module for Emplo yees; this is an ann ual requir ement. The n, attach your certi ficate of completion with the telework a greement f orms. Star t by askin g your sup ervisor fo r directio ns to comp lete the r equest. | |
939 | Rules of B ehavior | |
940 | INFORMATIO N SECURITY RULES of BEHAVIOR Telework a nd Remote Access | |
941 | ||
942 | ||
943 | Keep gover nment furn ished equi pment (GFE ) and VA i nformation safe, sec ure, and s eparated f rom my per sonal prop erty and i nformation , regardle ss of work location. I will pr otect GFE from theft , loss, de struction, misuse, a nd emergin g threats. SOURCE: A C-17 | |
944 | Safeguard VA sensiti ve informa tion, in a ny format, device, s ystem and/ or softwar e in remot e location s (e.g., a t home and during tr avel). SOU RCE: AC-17 | |
945 | Provide au thorized O l&T person nel access to inspec t the remo te locatio n pursuant to an app roved tele work agree ment that includes a ccess to V A sensitiv e informat ion. SOURC E: AC-17 | |
946 | I Will Not : | |
947 | ||
948 | Access non -public VA informati on technol ogy resour ces from p ublicly-av ailable IT computers , such as remotely c onnecting to the int ernal VA n etwork fro m computer s in a pub lic librar y. SOURCE: AC-17 | |
949 | ||
950 | Knowledge Check: Rem ote Access | |
951 | Consider t he followi ng questio n by selec ting the b est answer . | |
952 | Which of t he followi ng is allo wed under VA’s remot e access a nd telewor k policies ? | |
953 | ||
954 | Connecting to VA res ources thr ough a per sonal VPN you set up | |
955 | Sending dr aft docume nts of a p ending VA policy fro m your per sonal Gmai l account | |
956 | Connecting to VA res ources thr ough the V PN using y our PIV ca rd and pas sword | |
957 | The correc t answer C . Use VA-a pproved re mote acces s methods to access VA resourc es and to conduct VA business whenever y ou are con necting fr om outside of a VA f acility. C onnect thr ough the V PN by usin g a PIV ca rd and pas sword. You must have approval to have re mote acces s. | |
958 | ||
959 | Risks and Threats | |
960 | VA informa tion syste ms, softwa re, and ne tworks nee d ongoing protection from thre ats that c an expose VA sensiti ve informa tion. The VA NSOC mo nitors all network t raffic for unusual o r unapprov ed activit ies. | |
961 | Here are s ome action s you can take to pr otect VA i nformation systems: | |
962 | ||
963 | Never give your pass word to an yone | |
964 | ||
965 | ||
966 | Never down load a pro gram or so ftware fro m the Inte rnet onto your VA-is sued compu ter | |
967 | Check with your supe rvisor, IS O, and you r local Of fice of In formation and Techno logy (OI&T ) represen tative to request ad ditional s oftware | |
968 | Be suspici ous of vir us alerts on web pag es, and ne ver click on untrust ed links | |
969 | Report all suspected threats a nd warning s to your ISO | |
970 | ||
971 | While VA n etwork con trols and tools filt er out a l ot of the informatio n security threats, some do ma nage to ge t through. | |
972 | More Infor mation | |
973 | Malware, p hishing, a nd spoofin g are comm on risks a nd threats that you may see in the form of emails and attach ments. Kno w the risk s and acti ons to tak e when you receive a ny suspici ous emails or attach ments. | |
974 | Malware | |
975 | ||
976 | Malware is software that can h arm a comp uter or sy stem. It i ncludes vi ruses, wor ms, Trojan horses, a nd spyware . | |
977 | Risks: | |
978 | ||
979 | Interrupts computer function | |
980 | Collects V A sensitiv e informat ion | |
981 | Gains unap proved acc ess to com puter syst ems | |
982 | Alters or deletes VA sensitive informati on Protect ion Method s: | |
983 | Access and use only VA-approve d security software, which are listed on the One-V A Technica l Referenc e Model (s ee the Res ources sec tion for i nformation ) | |
984 | Do not ope n suspicio us email a ttachments or websit es | |
985 | Do not sel ect links inside pop -ups | |
986 | Do not dow nload unap proved sof tware, fre e trials, etc. | |
987 | ||
988 | Phishing a nd Spoofin g | |
989 | ||
990 | Phishing i s an effor t to steal personal data or in formation through an email or URL link. Many times phishing attacks us e spoofing . Spoofing is an att empt to mo dify code in an emai l so the r ecipient t hinks it i s from a k nown or tr usted pers on. | |
991 | Risks: | |
992 | ||
993 | Collects V A sensitiv e informat ion by pre tending to be an hon est source | |
994 | ||
995 | ||
996 | Appears as a link to a real we bsite and redirects the user t o a fake s ite Protec tion Metho ds: | |
997 | Right-clic k the susp icious lin k to displ ay the URL | |
998 | Ensure you have VA-a pproved en cryption o n your dev ices | |
999 | Type the w ebsite add ress inste ad of sele cting prov ided links | |
1000 | ||
1001 | Rules of B ehavior | |
1002 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
1003 | I Will: | |
1004 | ||
1005 | Use only V A-approved devices, systems, s oftware, s ervices, a nd data wh ich I am a uthorized to use, in cluding co mplying wi th any sof tware lice nsing or c opyright r estriction s. SOURCE: AC-6 | |
1006 | Only use V A-approved solutions for conne cting non- VA-owned s ystems to VA's netwo rk. SOURCE : AC-20 | |
1007 | Electronic Data Prot ection | |
1008 | ||
1009 | I Will: | |
1010 | ||
1011 | Only use v irus prote ction soft ware, anti -spyware, and firewa ll/intrusi on detecti on softwar e authoriz ed by VA. SOURCE: Sl -3 | |
1012 | I Will Not : | |
1013 | ||
1014 | Download s oftware fr om the Int ernet, or other publ ic availab le sources , offered as free tr ials, shar eware; or other unli censed sof tware to a VA-owned system. SO URCE: CM-1 1 | |
1015 | Identifica tion and A uthenticat ion | |
1016 | ||
1017 | I Will: | |
1018 | ||
1019 | Protect my passwords ; verify c odes, toke ns, and cr edentials from unaut horized us e and disc losure. SO URCE: IA-5 (h) | |
1020 | ||
1021 | Making the Connectio n: Wendy’s Story | |
1022 | ||
1023 | ||
1024 | Unauthoriz ed Access | |
1025 | My daughte r just got a job in patient bi lling for the VA hea lth care f acility wh ere I am a patient. I asked he r to look up my pers onal medic al records to see if she could find out my latest test resul ts. | |
1026 | I am worri ed about t hose resul ts, and I’ ve called the clinic twice. | |
1027 | I was surp rised when she said she can’t do that. S he said VA employees have to h ave a job- related ne ed to know before th ey can see anyone’s personal i nformation and they also have to be auth orized by IT. You kn ow, even i f she coul dn’t do wh at I wante d, I was g lad to lea rn that VA has rules to protec t my perso nal health informati on. | |
1028 | Be careful to use on ly the inf ormation y ou are aut horized to use for d oing your job. | |
1029 | Insider Th reats | |
1030 | One of the biggest t hreats to any organi zation’s d ata and in formation networks i s the peop le who hav e the easi est access : insiders . Organiza tions are exposed to insider t hreats whe n employee s have acc ess to sen sitive inf ormation o r systems and the or ganization does not have effec tive contr ols or is not enforc ing contro ls to prev ent misuse . | |
1031 | Many peopl e are natu rally curi ous, but a cting on y our curios ity can le ad to viol ating priv acy and co nfidential ity. This will weake n Veterans ’ trust in VA. | |
1032 | Insiders k now how a facility o perates an d may have access to informati on that th ey can be tempted to use illeg ally or ev en sell to others. T he potenti al for fra ud increas es when th e opportun ity is ava ilable. Av oid being caught up in an ille gal scam b y closely following all of the ROB. | |
1033 | Help prote ct VA from insider t hreats by noticing o dd behavio rs. Rememb er, if som ething a c olleague i s doing do esn’t seem quite rig ht, report it as an incident. | |
1034 | ||
1035 | More Infor mation | |
1036 | Insider Th reats | |
1037 | ||
1038 | Risks: | |
1039 | ||
1040 | An insider could use authorize d access, by acciden t or by in tent, to h arm inform ation syst ems and VA sensitive informati on | |
1041 | An insider could bec ome an inv oluntary t hreat by o pening an attachment containin g a virus that insta lls when o pened | |
1042 | An insider could be a social e ngineer, a friendly actor who charms you into disc losing VA sensitive informatio n | |
1043 | Prevention : | |
1044 | ||
1045 | Never shar e your pas sword or o ther accou nt informa tion, even with trus ted cowork ers | |
1046 | Verify any requests for VA sen sitive inf ormation b efore rele asing it, even if th e request seems harm less to yo u | |
1047 | Use the ac cess you’v e been giv en to the network on ly to perf orm your o fficial du ties. If y ou require more acce ss, go thr ough appro priate cha nnels to g et it | |
1048 | Rules of B ehavior | |
1049 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Identif ication an d Authenti cation | |
1050 | I Will: | |
1051 | ||
1052 | Protect my passwords ; verify c odes, toke ns, and cr edentials from unaut horized us e and disc losure. SO URCE: IA-5 (h) | |
1053 | Incident R eporting | |
1054 | ||
1055 | I Will: | |
1056 | ||
1057 | Report sus pected or identified informati on securit y incident s includin g anti-vir us, antisp yware, fir ewall or i ntrusion d etection s oftware er rors, or s ignificant alert mes sages (sec urity and privacy) t o my VA su pervisor o r designee immediate ly upon su spicion. S OURCE: IR- 6 | |
1058 | Preventing Attacks | |
1059 | You can he lp prevent attacks o n VA infor mation sys tems by fo llowing th ese guidel ines: | |
1060 | ||
1061 | ||
1062 | Follow ins tructions to update your VA-ap proved sec urity soft ware | |
1063 | Avoid stra nge websit es | |
1064 | Avoid open ing strang e emails o r attachme nts | |
1065 | Never disa ble or byp ass system controls to access VA sensiti ve informa tion, unle ss specifi cally auth orized by your local CIO | |
1066 | Report any thing odd on your co mputer sys tem to you r ISO, suc h as: | |
1067 | ||
1068 | Odd charac ters in a document o r email | |
1069 | Missing da ta | |
1070 | Sudden inc reases in spam or un solicited email | |
1071 | Strange at tachments in emails | |
1072 | ||
1073 | Rules of B ehavior | |
1074 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Protect ion of Com puting Res ources | |
1075 | I Will Not : | |
1076 | ||
1077 | Attempt to override, circumven t, alter o r disable operationa l, technic al, or man agement se curity con figuration controls unless exp ressly dir ected to d o so by au thorized V A staff. S OURCE: CM- 3 | |
1078 | Electronic Data Prot ection | |
1079 | ||
1080 | I Will Not : | |
1081 | ||
1082 | Disable or degrade s oftware pr ograms use d by VA th at install security software u pdates to VA compute r equipmen t, to comp uter equip ment used to connect to VA inf ormation s ystems, or used to c reate, sto re or use VA informa tion. SOUR CE: CM-10 | |
1083 | Incident R eporting | |
1084 | ||
1085 | I Will: | |
1086 | ||
1087 | Report sus pected or identified informati on securit y incident s includin g anti-vir us, antisp yware, fir ewall or i ntrusion d etection s oftware er rors, or s ignificant alert mes sages (sec urity and privacy) t o my VA su pervisor o r designee immediate ly upon su spicion. S OURCE: IR- 6 | |
1088 | ||
1089 | ||
1090 | Interactiv e Exercise #1: Preve nting Atta cks | |
1091 | It’s time for an int eractive e xercise. S elect the correct an swer for e ach of the questions based on the inform ation prov ided. | |
1092 | ||
1093 | Exercise # 1: Scenari o | |
1094 | An email m essage tha t has a *. zip attach ment from a vendor. | |
1095 | You receiv e an email with an a ttachment (zip file with gener ic name of “attachme nt.zip”) | |
1096 | from a ven dor you ha ve never h eard of. T he subject line says Various E xports FW: Here’s a list of ou r products . | |
1097 | ||
1098 | Exercise # 1: Questio n | |
1099 | Do you ope n the atta chment? | |
1100 | ||
1101 | Yes | |
1102 | No | |
1103 | ||
1104 | The correc t answer i s No. Neve r open an attachment from an u nknown ema il address . Never fo rward the email with the attac hment beca use it has the poten tial to ca use furthe r damage t o the netw ork. | |
1105 | ||
1106 | ||
1107 | Interactiv e Exercise #2: Preve nting Atta cks | |
1108 | Select the correct a nswer for each of th e question s based on the infor mation pro vided. | |
1109 | ||
1110 | Exercise # 2: Scenari o | |
1111 | A browser window wit h a Securi ty Alert d ialog box stating “Y our curren t security settings do not all ow this fi le to be d ownloaded. ” | |
1112 | ||
1113 | ||
1114 | ||
1115 | You are at home work ing on you r VA- issu ed laptop. A friend stops by a nd wants t o show you a website . You type in | |
1116 | ||
1117 | Exercise # 2: Questio n | |
1118 | Do you byp ass the se curity con trols and disable th e antiviru s so that you can vi ew the con tent? | |
1119 | Yes | |
1120 | No | |
1121 | ||
1122 | The correc t answer i s No. Neve r bypass o r risk sec urity and controls o f VA syste ms and dev ices. | |
1123 | ||
1124 | ||
1125 | Interactiv e Exercise #2: Preve nting Atta cks | |
1126 | the web ad dress and realize on ly some of the conte nt is disp layed. You r friend s uggests th at you dis able your laptop’s f irewall an d antiviru s so you c an access the page. | |
1127 | ||
1128 | ||
1129 | ||
1130 | Interactiv e Exercise #3: Preve nting Atta cks | |
1131 | Select the correct a nswer for each of th e question s based on the infor mation pro vided. | |
1132 | ||
1133 | Exercise # 3: Scenari o | |
1134 | A woman on the phone sitting i n front of her lapto p. | |
1135 | You receiv e a call f rom an ano nymous num ber, and t he caller states tha t your com puter | |
1136 | has been i nfected wi th a virus and that he or she needs your username and passwo rd to trou bleshoot. | |
1137 | ||
1138 | Exercise # 3: Questio n | |
1139 | Is this an example o f a possib le social engineerin g attack? | |
1140 | Yes | |
1141 | No | |
1142 | ||
1143 | The correc t answer i s Yes. Thi s could be a social engineerin g attack. There are people who may use a friendly or officia l manner t o try to t rick you i nto giving them info rmation or performin g unauthor ized actio ns on VA e quipment o r systems. Never giv e your pas sword to a nyone. | |
1144 | ||
1145 | Connecting Points | |
1146 | Here are t he connect ing points to recall to keep V A systems secure: | |
1147 | ||
1148 | Access onl y the VA n etworks an d systems you are au thorized t o access | |
1149 | Follow VA guidelines and polic ies when y ou access networks a nd systems wirelessl y or remot ely | |
1150 | If you are a telewor ker, follo w VA’s tel ework poli cy | |
1151 | Recognize and report threats t o VA syste ms, includ ing common and insid er threats | |
1152 | ||
1153 | ||
1154 | Module 5: Using Equi pment and Devices Se curely | |
1155 | Objectives | |
1156 | Equipment and device s at VA co me in all sizes and shapes. So me are big and stati onary, suc h as a des ktop compu ter. Other s are smal l and port able, such as a mobi le phone. Despite th e differen ces, they all have p rivacy and security risks that you must manage. | |
1157 | When you h ave comple ted this t opic, you will be ab le to: | |
1158 | ||
1159 | Recall how to use VA -issued de vices secu rely to pr event unau thorized a ccess to V A sensitiv e informat ion | |
1160 | Recognize when you m ay use per sonally ow ned equipm ent for VA business | |
1161 | ||
1162 | Making the Connectio n: Christo pher’s Sto ry | |
1163 | ||
1164 | ||
1165 | Missing Eq uipment | |
1166 | I had to s top at the store on my way hom e from wor k last wee k. While I was in th e store, s omeone bro ke into my car and t ook my VA- issued equ ipment. Th ey stole m y iPad, ce ll phone, and PIV ca rd. Even m y personal laptop wa s stolen. | |
1167 | Since it’s my respon sibility, I quickly notified t he local p olice depa rtment and VA Police Service a nd both ha ve taken s tatements along with police re ports. The wireless | |
1168 | carrier wa s notified and termi nated cell ular servi ce to the iPad and c ell phone. VA IT had the iPad remotely e rased. | |
1169 | Protect th e devices that are a ssigned to you. You are respon sible for the care, use, and p rotection of these d evices and the infor mation sto red on the m. | |
1170 | Inventory Control fo r Electron ic Devices | |
1171 | VA employe es, contra ctors, and volunteer s use VA e lectronic devices to support t heir work. | |
1172 | Examples o f electron ic devices include d esktop com puters, la ptops, Bla ckBerrys, Apple inte rnet opera ting syste m (iOS) de vices, And roid devic es, univer sal serial bus (USB) drives, b iomedical equipment, and copy machines. Inventory control is important because i t ensures VA equipme nt is not lost or st olen and i s in the c orrect pla ce. | |
1173 | ||
1174 | More Infor mation | |
1175 | Here is wh at you nee d to remem ber to kee p track of electroni c devices and keep t hem secure : | |
1176 | Protect th e devices that are a ssigned to you. You are respon sible for the care, use, and p rotection of these d evices and the infor mation sto red on the m | |
1177 | Be especia lly carefu l with you r laptop i n airport security l ines. The airport se curity con veyor belt is a comm on place f or laptop theft. Pla ce your co mputer on the belt o nly when y ou are the next in l ine, and a lways keep your eyes on it | |
1178 | Work with your super visor to n otify your IT invent ory coordi nators pri or to chan ging locat ions or ch anging job s. IT equi pment has to be acco unted for, like all other fede ral proper ty. Missin g laptops, data cabl es, and ot her IT equ ipment mea ns possibl e risk for Veterans and lost r esources f or VA | |
1179 | Agree to p eriodic el ectronic d evice insp ections | |
1180 | Enable VA- approved s ecurity to ols | |
1181 | ||
1182 | Rules of B ehavior | |
1183 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
1184 | I Will Not : | |
1185 | ||
1186 | Engage in any activi ty that is prohibite d by VA Di rective 60 01, Limite d Personal Use of Go vernment O ffice Equi pment Incl uding Info rmation Te chnology. SOURCE: AC -8 | |
1187 | Protection of Comput ing Resour ces | |
1188 | ||
1189 | I Will Not : | |
1190 | ||
1191 | Swap or su rrender VA hard driv es or othe r storage devices to anyone ot her than a n authoriz ed OI&T em ployee. SO URCE: MP-4 | |
1192 | Electronic Data Prot ection | |
1193 | ||
1194 | I Will: | |
1195 | ||
1196 | Only use v irus prote ction soft ware, anti -spyware, and firewa ll/intrusi on detecti on softwar e authoriz ed by VA. SOURCE: Sl -3 | |
1197 | ||
1198 | Teleworkin g and Remo te Access | |
1199 | ||
1200 | I Will: | |
1201 | ||
1202 | Keep gover nment furn ished equi pment (GFE ) and VA i nformation safe, sec ure, and s eparated f rom my per sonal prop erty and i nformation , regardle ss of work location. SOURCE: A C-17 | |
1203 | Protect GF E from the ft, loss, destructio n, misuse, and emerg ing threat s. SOURCE: AC-17 | |
1204 | User Accou ntability | |
1205 | ||
1206 | I Will: | |
1207 | ||
1208 | Understand that auth orized VA personnel may review my conduc t or actio ns concern ing VA inf ormation a nd informa tion syste ms, and ta ke appropr iate actio n. SOURCE: AU-1 | |
1209 | Have my GF E scanned and servic ed by VA a uthorized personnel. This may require me to return it prompt ly to a VA facility upon deman d. SOURCE: MA-2 | |
1210 | Permit onl y those au thorized b y Ol&T to perform ma intenance on IT comp onents, in cluding in stallation or remova l of hardw are or sof tware. SOU RCE: MA-5 | |
1211 | Medical De vices | |
1212 | Some lapto ps that ru n software for biome dical equi pment or d evices can not be enc rypted. Si nce VA nee ds these d evices to treat pati ents and s tore patie nt informa tion, thes e devices are exempt from encr yption, bu t must be placed on a separate local are a network (LAN) or v irtual loc al area ne twork (VLA N) to ensu re securit y. Before disposing of biomedi cal equipm ent capabl e of stori ng informa tion elect ronically, contact y our CIO an d ISO. | |
1213 | NSOC’s Ent erprise Ne twork Defe nse (END) team recom mends ensu ring that all medic al devices are prote cted in ac cordance w ith VA pol icies. You can find the Field Security S ervice Hea lth Inform ation Secu rity Divis ion ShareP oint site for Medica l Device P rotection Program (M DPP) guida nce in the Resources section. Work with device ven dors to en sure all s oftware is secure an d properly patched a nd that ap propriate security m easures, s uch as str ong passwo rds, are e mployed wh ere applic able. Repo rt inciden ts to NSOC . | |
1214 | More Infor mation | |
1215 | A wide cro ss section of biomed ical devic es share s ome common security risks, inc luding: | |
1216 | ||
1217 | ||
1218 | Lack of va lidation t o access o r use the equipment | |
1219 | Weak or de fault pass words like “admin” o r “1234” | |
1220 | Embedded w eb servers and inter faces that make biom edical dev ices an ea sy threat | |
1221 | Embedded w eb service s that all ow devices to commun icate with one anoth er | |
1222 | ||
1223 | Rules of B ehavior | |
1224 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
1225 | I Will: | |
1226 | ||
1227 | Use only V A-approved devices, systems, s oftware, s ervices, a nd data wh ich I am a uthorized to use, in cluding co mplying wi th any sof tware lice nsing or c opyright r estriction s. SOURCE: AC-6 | |
1228 | Only use V A-approved solutions for conne cting non- VA-owned s ystems to VA's netwo rk. SOURCE : AC-20 | |
1229 | Protection of Comput ing Resour ces | |
1230 | ||
1231 | I Will: | |
1232 | ||
1233 | Secure mob ile device s and port able stora ge devices (e.g., la ptops, Uni versal Ser ial Bus (U SB) flash drives, sm artphones, tablets, personal d igital ass istants (P DA)). SOUR CE: AC-19 | |
1234 | Identifica tion and A uthenticat ion | |
1235 | ||
1236 | I Will: | |
1237 | ||
1238 | Use passwo rds that m eet the VA minimum r equirement s. SOURCE: IA-5 (1) | |
1239 | ||
1240 | Using VA-I ssued Devi ces Secure ly | |
1241 | You are re sponsible for the ca re, use, a nd protect ion of any VA-issued devices a nd the inf ormation s tored on t hem. | |
1242 | To protect the infor mation on your VA de vices: | |
1243 | ||
1244 | Keep your security s oftware up -to-date, following VA’s guida nce | |
1245 | Use VA-app roved encr yption and passwords | |
1246 | Enable VA- approved s ecurity to ols | |
1247 | Never open attachmen ts from an unknown s ender | |
1248 | ||
1249 | ||
1250 | Never sele ct a URL s ent by an unknown se nder direc ting you t o a websit e. This is typically simple to spot, as most email s from unk nown sende rs and out side of VA have “[EX TERNAL]” a ppended to the subje ct line | |
1251 | Report all odd messa ges or sus pected thr eats and w arnings to your ISO | |
1252 | ||
1253 | For more i nformation about enc ryption fo r your VA devices, c ontact you r ISO or t he VA Nati onal Servi ce Desk. | |
1254 | More Infor mation | |
1255 | Know the r ules | |
1256 | ||
1257 | Get approv al from yo ur supervi sor, local ISO, and CIO before you trans port, tran smit, acce ss, or use VA sensit ive inform ation remo tely. | |
1258 | Protect pa tient data and your informatio n | |
1259 | ||
1260 | Only certa in VA-issu ed devices have been approved for use wi th VA sens itive info rmation. N ever assum e that a V A-issued d evice is p rotected a nd allowed for use w ith VA sen sitive inf ormation w ithout cle ar guidanc e from OI& T or your ISO. | |
1261 | Keep it wi th you | |
1262 | ||
1263 | Never leav e any of y our mobile devices o r portable equipment unattende d. Smaller mobile de vices that do not ha ve the abi lity to us e a cable lock shoul d be kept with you p ersonally or in a se cure place , such as a locked c abinet, de sk, or saf e, if avai lable. If you are wo rking in a n uncontro lled area, use VA-is sued cable locks for laptops a nd tablets with this capabilit y to help keep your equipment secure, an d keep you r smaller mobile dev ices that are unable to be cab le locked with you. | |
1264 | Safeguard VA data | |
1265 | ||
1266 | Do not ins tall any n on-VA appr oved appli cations on to your mo bile devic e if they have not b een approv ed by VA. Many appli cations ex ist on the se platfor ms that ha ve the abi lity to ga in access to secure VA data th rough clou d connecti ons, as we ll as harm ful applic ations tha t try to u se your mo bile devic e as a gat eway into the VA net work. If t here are a pplication s that you believe s hould be m ade availa ble to you on these mobile pla tforms, re quests for approval can be mad e through the VA Nat ional Serv ice Desk. It is very important to enter patient or governmen t sensitiv e informat ion only i n approved applicati ons. Non-V A approved apps coul d take sen sitive dat a and tran smit it to anyone, i ncluding r ecipients in foreign countries . | |
1267 | Rules of B ehavior | |
1268 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R | |
1269 | ||
1270 | Protection of Comput ing Resour ces | |
1271 | ||
1272 | I Will: | |
1273 | ||
1274 | Secure mob ile device s and port able stora ge devices (e.g., la ptops, Uni versal Ser ial Bus (U SB) flash drives, sm artphones, tablets, personal d igital ass istants (P DA)). SOUR CE: AC-19 | |
1275 | I Will Not : | |
1276 | ||
1277 | Attempt to override, circumven t, alter o r disable operationa l, technic al, or man agement se curity con figuration controls unless exp ressly dir ected to d o so by au thorized V A staff. S OURCE: CM- 3 | |
1278 | Electronic Data Prot ection | |
1279 | ||
1280 | I Will: | |
1281 | ||
1282 | Only use v irus prote ction soft ware, anti -spyware, and firewa ll/intrusi on detecti on softwar e authoriz ed by VA. SOURCE: Sl -3 | |
1283 | I Will Not : | |
1284 | ||
1285 | Disable or degrade s oftware pr ograms use d by VA th at install security software u pdates to VA compute r equipmen t, to comp uter equip ment used to connect to VA inf ormation s ystems, or used to c reate, sto re or use VA informa tion. SOUR CE: CM-10 | |
1286 | Identifica tion and A uthenticat ion | |
1287 | ||
1288 | I Will: | |
1289 | ||
1290 | Use passwo rds that m eet the VA minimum r equirement s. SOURCE: IA-5 (1) | |
1291 | ||
1292 | Policy and Use of VA -Issued De vices | |
1293 | VA allows limited pe rsonal use of govern ment offic e equipmen t, includi ng informa tion techn ology. | |
1294 | VA employe es may acc ess and us e VA-issue d devices and equipm ent (e.g., mobile te lephones, tablets, c omputers, and copier s) for per sonal acti vities, as long as t his limite d personal use is oc curring wi th supervi sor approv al, and it : | |
1295 | Does not i nterfere w ith work | |
1296 | Does not a ffect prod uctivity | |
1297 | Does not v iolate sta ndards of ethical co nduct | |
1298 | ||
1299 | Contractor s may not access or use VA-iss ued device s for pers onal use u nless it i s stated i n the term s of the c ontract. | |
1300 | No one may access or use VA-is sued devic es for pro hibited ac tivities. | |
1301 | ||
1302 | More Infor mation | |
1303 | Prohibited activitie s include, but are n ot limited to: | |
1304 | ||
1305 | Creating, viewing, o r sending pornograph ic materia l | |
1306 | Creating, viewing, o r sending material r elated to gambling, illegal we apons, ter rorist act ivities, o r other il legal acti vities | |
1307 | Creating, copying, o r sending chain lett ers | |
1308 | Sending un approved m ass mailin gs | |
1309 | Supporting “for prof it” activi ties outsi de of VA | |
1310 | Participat ing in una pproved lo bbying or fundraisin g | |
1311 | ||
1312 | Rules of B ehavior | |
1313 | 2. COMPLIA NCE | |
1314 | ||
1315 | 2b. Unauth orized acc essing, up loading, d ownloading , changing , circumve nting, or deleting o f informat ion on VA systems; u nauthorize d modifyin g VA syste ms, denyin g or grant ing access to VA sys tems; usin g VA resou rces for u nauthorize d use on V A systems; or otherw ise misusi ng VA syst ems or res ources is strictly p rohibited. | |
1316 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
1317 | I Will: | |
1318 | ||
1319 | Only use m y access t o VA compu ter system s and/or r ecords for officiall y authoriz ed and ass igned duti es. SOURCE : AC-6 | |
1320 | Only use V A-approved solutions for conne cting non- VA-owned s ystems to VA's netwo rk. SOURCE : AC-20 | |
1321 | I Will Not : | |
1322 | ||
1323 | Engage in any activi ty that is prohibite d by VA Di rective 60 01, Limite d Personal Use of Go vernment O ffice Equi pment incl uding Info rmation Te chnology. SOURCE: AC -8 | |
1324 | ||
1325 | Privacy an d Security on VA Mob ile Device s | |
1326 | If you hav e a VA mob ile device , be sure you know t he require ments for protecting privacy a nd ensurin g security when usin g apps. | |
1327 | Downloadin g Public A pps | |
1328 | When downl oaded, man y public a pps ask us ers for ac cess to in formation stored on a user’s d evice. | |
1329 | VA require s users to click “Do n’t Allow” for all p op-ups req uesting ac cess to co ntacts, ph otos, cale ndar, and other sett ings. Clic king “OK” to such re quests for access wh en downloa ding, inst alling, or using pub lic apps m ay open th e device t o potentia l tracing capabiliti es and put your devi ce data at risk. | |
1330 | Confirm wh ere the ap p data is being stor ed to ensu re that no VA sensit ive inform ation is s tored on t he Cloud. Do not aut omatically accept ac cess reque sts for in formation such as: | |
1331 | Location | |
1332 | Contacts | |
1333 | Calendar | |
1334 | Photos | |
1335 | Microphone | |
1336 | ||
1337 | Public App s and PHI/ PII | |
1338 | No public apps shoul d contain sensitive informatio n regardle ss of the security i mplied by the manufa cturer or developer. You must protect VA sensitive informati on when yo u use any type of el ectronic d evice or c ommunicati on to stor e, transpo rt, or dis pose of in formation. | |
1339 | Mobile Dev ice Privac y Settings | |
1340 | In the pri vacy secti on of the settings o ption on y our mobile device, y ou have th e ability to see whi ch apps ar e accessin g your dat a. Be proa ctive abou t updating your priv acy settin gs to ensu re that no ne of your apps are putting yo ur data, o r your pat ient’s dat a, at risk . | |
1341 | If you are not recei ving or in putting an y informat ion relate d to VA on your gove rnment- fu rnished de vice, then you can d ownload ap ps from ot her public app store s, but you must part icipate in the manda tory train ing prior to doing s o. | |
1342 | Rules of B ehavior | |
1343 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R | |
1344 | ||
1345 | Access and Use of VA Informati on Systems | |
1346 | ||
1347 | I Will Not : | |
1348 | ||
1349 | Engage in any activi ty that is prohibite d by VA Di rective 60 01, Limite d Personal Use of Go vernment O ffice Equi pment Incl uding Info rmation Te chnology. SOURCE: AC -8 | |
1350 | Electronic Data Prot ection | |
1351 | ||
1352 | I Will: | |
1353 | ||
1354 | Safeguard VA mobile devices an d portable storage d evices con taining VA informati on, at wor k and remo tely, usin g FIPS 140 -2 validat ed encrypt ion (or it s successo r) unless it is not technicall y possible . This inc ludes lapt ops, flash drives, a nd other r emovable s torage dev ices and s torage med ia (e.g., Compact Di scs (CD), Digital Vi deo Discs (DVD)). SO URCE: SC-1 3 | |
1355 | Only use d evices enc rypted wit h FIPS 140 -2 (or its successor ) validate d encrypti on. VA own ed and app roved stor age device s/media mu st use VA' s approved configura tion and s ecurity co ntrol requ irements. SOURCE: SC -28 | |
1356 | I Will Not : | |
1357 | ||
1358 | Download s oftware fr om the Int ernet, or other publ ic availab le sources , offered as free tr ials, shar eware; or other unli censed sof tware to a VA-owned system. SO URCE: CM-1 1 | |
1359 | Apps | |
1360 | Software a pplication s or “apps ” can make some task s faster a nd easier on mobile devices. I f the VA A pp Catalog does not have the a pps you ne ed for you r VA task, you may n eed to dow nload apps from a pu blic app s tore. All VA ROB mus t be follo wed. VA- a pproved pu blic app s tores incl ude: | |
1361 | Apple App Store | |
1362 | Google Pla y Store | |
1363 | ||
1364 | If you are authorize d to use V A mobile d evices, us e due dili gence and the highes t ethical standards when downl oading fro m public a pp stores and updati ng any pub lic apps. Make sure you unders tand app s oftware up dates and ensure the re is no p rivacy or security r isk associ ated with the update . You may also be re quired to take manda tory train ing. | |
1365 | ||
1366 | ||
1367 | If you dow nload and use apps o n your mob ile device : | |
1368 | ||
1369 | Protect VA sensitive informati on when yo u use any type of el ectronic d evice or c ommunicati on to stor e, transpo rt, or dis pose of in formation | |
1370 | Get approv al to down load apps to your VA device | |
1371 | Use only a pps availa ble in the VA App Ca talog with VA sensit ive data a nd informa tion | |
1372 | Be wary of pop-ups t hat might request ac cess to yo ur informa tion | |
1373 | Do not use public ap ps that st ore or pro cess PII o r PHI | |
1374 | ||
1375 | Mandatory Training | |
1376 | If you are not recei ving or en tering any informati on related to VA on your gover nment- fur nished dev ice, then you can do wnload app s from oth er public app stores , but you must parti cipate in the mandat ory traini ng prior t o doing so . | |
1377 | To use and download public app s through public app stores, y ou must pa rticipate in a manda tory train ing sessio n availabl e through the MyVeHU Campus ti tled Prote cting Priv acy and Se curity Whi le Using A pps from t he Public App Store. | |
1378 | Other trai ning avail able on th e TMS incl udes the M obile Trai ning: Secu rity of Ap ps on iOS Devices (T MS: 392674 4). See Ap pendix D, Privacy an d Informat ion Securi ty Resourc es for mor e informat ion. | |
1379 | Rules of B ehavior | |
1380 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
1381 | I Will: | |
1382 | ||
1383 | Use only V A-approved devices, systems, s oftware, s ervices, a nd data wh ich I am a uthorized to use, in cluding co mplying wi th any sof tware lice nsing or c opyright r estriction s. SOURCE: AC-6 | |
1384 | Only use V A-approved solutions for conne cting non- VA-owned s ystems to VA's netwo rk. SOURCE : AC-20 | |
1385 | Electronic Data Prot ection | |
1386 | ||
1387 | I Will: | |
1388 | ||
1389 | Safeguard VA mobile devices an d portable storage d evices con taining VA informati on, at wor k and remo tely, usin g FIPS 140 -2 validat ed encrypt ion (or it s | |
1390 | ||
1391 | successor) unless it is not te chnically possible. This inclu des laptop s, flash d rives, and other rem ovable sto rage devic es and sto rage media (e.g., Co mpact Disc s (CD), Di gital Vide o Discs (D VD)). SOUR CE: SC-13 | |
1392 | Only use d evices enc rypted wit h FIPS 140 -2 (or its successor ) validate d encrypti on. VA own ed and app roved stor age device s/media mu st use VA' s approved configura tion and s ecurity co ntrol requ irements. SOURCE: SC -28 | |
1393 | I Will Not : | |
1394 | ||
1395 | Download s oftware fr om the Int ernet, or other publ ic availab le sources , offered as free tr ials, shar eware; or other unli censed sof tware to a VA-owned system. SO URCE: CM-1 1 | |
1396 | Sensitive Informatio n | |
1397 | ||
1398 | I Will: | |
1399 | ||
1400 | Obtain app roval from my superv isor to us e, process , transpor t, transmi t, downloa d, print o r store el ectronic V A sensitiv e informat ion remote ly (outsid e of VA ow ned or man aged facil ities (e.g ., medical centers, community based outp atient cli nics (CBOC ), or regi onal offic es)). SOUR CE: UL-2 | |
1401 | ||
1402 | Interactiv e Exercise #1: VA-Is sued Devic es | |
1403 | It’s time for an int eractive e xercise. S elect the correct an swer for e ach of the questions based on the inform ation prov ided. | |
1404 | Exercise # 1: Scenari o | |
1405 | A mobile d evice with a message requestin g access t o personal data stat ing, “This app would like to a ccess your personal data…” and displayin g Don't Al low or All ow buttons | |
1406 | You want t o check ou t a new vi deo app an d load it on your VA mobile de vice. | |
1407 | You go to the public app store on the | |
1408 | Exercise # 1: Questio n | |
1409 | Do you sel ect Allow to permit access to your infor mation? | |
1410 | Yes | |
1411 | No | |
1412 | ||
1413 | The correc t answer i s No. Do n ot install or accept any appli cations on your VA m obile devi ce that ha ve not bee n approved by VA. So me applica tions may have the a bility to enable int ruders to gain acces s to secur e VA data through cl oud connec tions. Som e applicat ions can b e harmful applicatio ns that tr y to | |
1414 | ||
1415 | ||
1416 | ||
1417 | Internet, select Ins tall, and get a pop- up request ing access to inform ation stor ed on your device. | |
1418 | use your m obile devi ce as a ga teway into the VA ne twork. | |
1419 | ||
1420 | ||
1421 | Interactiv e Exercise #2: VA-Is sued Devic es | |
1422 | Select the correct a nswer for each of th e question s based on the infor mation pro vided. | |
1423 | Exercise # 2: Scenari o | |
1424 | An email f rom The Da ily Laugh with an an imated | |
1425 | gif attach ed. “Hey, check this out. It’s so funny! ” | |
1426 | Your | |
1427 | coworker w ants to se nd out a m ass email with a cut e animatio n for the holidays u sing the V A network. Is this e xample per mitted wit hin the gu idelines f or limited personal use? | |
1428 | Exercise # 2: Questio n | |
1429 | Your cowor ker wants to send ou t a mass e mail with a cute ani mation for the holid ays using the VA net work. Is t his exampl e permitte d within t he guideli nes for li mited pers onal use? | |
1430 | Yes | |
1431 | No | |
1432 | ||
1433 | The correc t answer i s No. This would be considered misuse of VA system s. VA Dire ctive 6001 provides guidelines for limit ed persona l use of V A issued d evices. Se nding mass emails wo uld be con sidered mi suse of VA systems. | |
1434 | ||
1435 | ||
1436 | Interactiv e Exercise #3: VA-Is sued Devic es | |
1437 | Select the correct a nswer for each of th e question s based on the infor mation pro vided. | |
1438 | ||
1439 | Exercise # 3: Scenari o | |
1440 | ||
1441 | Your VA-fu rnished la ptop has r eached its storage c apacity an d you have many file s that you do not wa nt to dele te. | |
1442 | ||
1443 | Exercise # 3: Questio n | |
1444 | Can you us e your per sonal exte rnal hard drive to s tore your VA sensiti ve documen ts? | |
1445 | Yes | |
1446 | No | |
1447 | ||
1448 | ||
1449 | ||
1450 | Image of a laptop wi th an exte rnal hard drive next to it. | |
1451 | The correc t answer i s No. Remo vable medi a may cont ain or all ow access to private informati on. This c ould lead to potenti al loss or exposure of sensiti ve Veteran informati on. Use VA -approved portable e lectronic devices, w hich are e ncrypted, adding a l ayer of pr otection t o your dat a. Never u se removab le media t o transfer data to a personal device. VA data shou ld only be located o n VA-appro ved device s. | |
1452 | ||
1453 | Personal E lectronic Devices | |
1454 | You must h ave permis sion to us e any pers onal elect ronic devi ces and pe rsonally o wned equip ment for V A work. Ke ep these g uidelines in mind wh en using p ersonal el ectronic d evices: | |
1455 | VA does no t allow yo u to bring your pers onally own ed equipme nt into a VA facilit y and conn ect to the network | |
1456 | Personally owned dev ices may o nly use CA G as a VA- approved r emote acce ss technol ogy to acc ess VA res ources | |
1457 | If you are approved to bring p ersonally owned equi pment into a VA faci lity, you must have approval f rom the Sy stem Owner or local CIO to use remote ac cess from your perso nally owne d equipmen t while in the facil ity | |
1458 | Never stor e VA sensi tive infor mation on any person al electro nic device | |
1459 | ||
1460 | Rules of B ehavior | |
1461 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
1462 | I Will: | |
1463 | ||
1464 | Use only V A-approved devices, systems, s oftware, s ervices, a nd data wh ich I am a uthorized to use, in cluding co mplying wi th any sof tware lice nsing or c opyright r estriction s. SOURCE: AC-6 | |
1465 | ||
1466 | Telework a nd Remote Access | |
1467 | ||
1468 | I Will: | |
1469 | ||
1470 | Obtain app roval prio r to using remote ac cess capab ilities to connect n on-GFE equ ipment to VA's netwo rk while w ithin the VA facilit y. SOURCE: AC-17 | |
1471 | Unencrypte d Devices | |
1472 | Some perso nal device s and equi pment may not connec t to a VA system but do connec t wireless ly to a VA device, s uch as wir eless head sets, wire less keybo ards, and Bluetooth devices. T hese devic es may be unencrypte d. | |
1473 | Wireless t elephone h eadset | |
1474 | Other peop le can lis ten to pho ne convers ations and download your data when you u se an unen crypted wi reless hea dset. Even encrypted wireless headsets a re a secur ity risk, especially when used outside o f a VA fac ility. Blu etooth hea dsets are not FIPS e ncrypted. Do not use a wireles s headset while work ing on VA business-r elated act ivities un less it me ets FIPS 1 40-2 valid ated encry ption and has been a pproved by your Faci lity CIO. | |
1475 | Wireless k eyboards | |
1476 | Do not use a wireles s keyboard while wor king on VA business- related ac tivities u nless it h as been ap proved by your Facil ity CIO. | |
1477 | Rules of B ehavior | |
1478 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
1479 | I Will: | |
1480 | ||
1481 | Use only V A-approved devices, systems, s oftware, s ervices, a nd data wh ich I am a uthorized to use, in cluding co mplying wi th any sof tware lice nsing or c opyright r estriction s. SOURCE: AC-6 | |
1482 | I Will Not : | |
1483 | ||
1484 | Have a VA network co nnection a nd a non-V A network connection (includin g a modem or phone l ine or wir eless netw ork card, etc.) phys ically con nected to any device at the sa me time un less the d ual connec tion is ex plicitly a uthorized. SOURCE: A C-17 | |
1485 | ||
1486 | ||
1487 | Host, set up, admini ster, or o perate any type of I nternet se rver or wi reless acc ess point on any VA network un less expli citly auth orized by my Informa tion Syste m Owner, l ocal CIO, or designe e and appr oved by my ISO. SOUR CE: AC-18 | |
1488 | Electronic Data Prot ection | |
1489 | ||
1490 | I Will: | |
1491 | ||
1492 | Safeguard VA mobile devices an d portable storage d evices con taining VA informati on, at wor k and remo tely, usin g FIPS 140 -2 validat ed encrypt ion (or it s successo r) unless it is not technicall y possible . This inc ludes lapt ops, flash drives, a nd other r emovable s torage dev ices and s torage med ia (e.g., Compact Di scs (CD), Digital Vi deo Discs (DVD)). SO URCE: SC-1 3 | |
1493 | Only use d evices enc rypted wit h FIPS 140 -2 (or its successor ) validate d encrypti on. VA own ed and app roved stor age device s/media mu st use VA' s approved configura tion and s ecurity co ntrol requ irements. SOURCE: SC -28 | |
1494 | I Will Not : | |
1495 | ||
1496 | Transmit V A sensitiv e informat ion via wi reless tec hnologies unless the connectio n uses FIP S 140-2 (o r its succ essor) val idated enc ryption. S OURCE: AC- 18 | |
1497 | Sensitive Informatio n | |
1498 | ||
1499 | I Will: | |
1500 | ||
1501 | Obtain app roval from my superv isor to us e, process , transpor t, transmi t, downloa d, print o r store el ectronic V A sensitiv e informat ion remote ly (outsid e of VA ow ned or man aged facil ities (e.g ., medical centers, community based outp atient cli nics (CBOC ), or regi onal offic es)). SOUR CE: UL-2 | |
1502 | Portable S torage and Removable Media | |
1503 | Portable s torage dev ices, such as thumb drives and portable hard drive s, and rem ovable med ia, such a s writeabl e DVDs, ar e convenie nt ways to transfer data. Howe ver, they create a r isk to pri vacy and s ecurity be cause they may conta in VA sens itive info rmation. I f you use these stor age device s or media , follow t hese restr ictions: | |
1504 | VA data sh ould only be stored and proces sed on VA- approved d evices | |
1505 | If you use a portabl e storage device, ma ke sure it is VA-app roved | |
1506 | Never use removable media to t ransfer da ta to a pe rsonal dev ice | |
1507 | Keep porta ble storag e devices and remova ble media secure whe n not in u se | |
1508 | ||
1509 | Rules of B ehavior | |
1510 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Protect ion of Com puting Res ources | |
1511 | I Will | |
1512 | ||
1513 | Secure mob ile device s and port able stora ge devices (e.g., la ptops, Uni versal Ser ial Bus (U SB) flash drives, sm artphones, tablets, personal d igital ass istants (P DA)). SOUR CE: AC-19 | |
1514 | Electronic Data Prot ection | |
1515 | ||
1516 | I Will: | |
1517 | ||
1518 | Safeguard VA mobile devices an d portable storage d evices con taining VA informati on, at wor k and remo tely, usin g FIPS 140 -2 validat ed encrypt ion (or it s successo r) unless it is not technicall y possible . This inc ludes lapt ops, flash drives, a nd other r emovable s torage dev ices and s torage med ia (e.g., Compact Di scs (CD), Digital Vi deo Discs (DVD)). SO URCE: SC-1 3 | |
1519 | Only use d evices enc rypted wit h FIPS 140 -2 (or its successor ) validate d encrypti on. VA own ed and app roved stor age device s/media mu st use VA' s approved configura tion and s ecurity co ntrol requ irements. SOURCE: SC -28 | |
1520 | Sensitive Informatio n | |
1521 | ||
1522 | I Will: | |
1523 | ||
1524 | Obtain app roval from my superv isor to us e, process , transpor t, transmi t, downloa d, print o r store el ectronic V A sensitiv e informat ion remote ly (outsid e of VA ow ned or man aged facil ities (e.g ., medical centers, community based outp atient cli nics (CBOC ), or regi onal offic es)). SOUR CE: UL-2 | |
1525 | ||
1526 | ||
1527 | ||
1528 | Knowledge Check: Per sonal Elec tronic Dev ices | |
1529 | Consider t he followi ng questio n by selec ting the b est answer . | |
1530 | Which of t he followi ng stateme nts is tru e regardin g the use of persona l electron ic devices at VA? | |
1531 | Personally owned dev ices may o nly use VA -approved remote acc ess techno logies to access VA resources | |
1532 | You can br ing any ty pe of equi pment into a VA faci lity and c onnect to the networ k without approval a s long as you protec t VA sensi tive infor mation | |
1533 | You can us e a remova ble storag e device t o transfer VA sensit ive inform ation to y our person al laptop at home | |
1534 | VA sensiti ve informa tion may b e stored o n your per sonal elec tronicdevi ce | |
1535 | The correc t answer A . Personal ly owned d evices may only use VA-approve d remote a ccess tech nologies t o access V A resource s. However , remember that you must have approval t o use any type of pe rsonally o wned devic e to conne ct remotel y. | |
1536 | ||
1537 | Connecting Points | |
1538 | Here are t he connect ing points to recall when usin g electron ic devices : | |
1539 | ||
1540 | Keep equip ment, stor age device s, and rem ovable med ia with yo u at all t imes | |
1541 | Use only V A-encrypte d electron ic devices that have been appr oved by yo ur ISO and CIO | |
1542 | Use only V A-approved apps from the VA Ap p Catalog for VA dat a | |
1543 | Do not acc ess VA sys tems with personal d evices or personally owned equ ipment wit hout autho rization | |
1544 | ||
1545 | ||
1546 | Module 6. Conversati ons and Em ail | |
1547 | Objectives | |
1548 | Everyday t asks, such as conver sations an d emailing , require security a wareness a t VA. Keep privacy a nd informa tion in mi nd when yo u talk to someone or communica te electro nically ab out VA sen sitive inf ormation. | |
1549 | When you h ave comple ted this t opic, you will be ab le to: | |
1550 | ||
1551 | Recall how to protec t VA sensi tive infor mation in conversati ons | |
1552 | Identify h ow to safe ly communi cate VA se nsitive in formation in electro nic messag es | |
1553 | Making the Connectio n: Tony’s Story | |
1554 | ||
1555 | ||
1556 | Be Aware o f Your Sur roundings | |
1557 | I recently attended a fellow V eteran’s f uneral ser vice. Ther e was a wo man, Wanda , who stoo d up to sp eak about Jack. As s he was tal king, I re alized tha t she may have compr omised his privacy b y sharing some stori es about h im while h e was bein g treated at VA’s me ntal healt h facility . | |
1558 | This made me feel un comfortabl e. | |
1559 | ||
1560 | Even thoug h Wanda wa s fond of Jack, she had the | |
1561 | responsibi lity as a VA employe e to maint ain his pr ivacy and not discus s that he had been t reated at a mental h ealth faci lity. Disc ussing Vet erans' sen sitive inf ormation s hould neve r happen i n a public setting. | |
1562 | Be aware o f your sur roundings when discu ssing sens itive conv ersations, and avoid revealing any VA se nsitive in formation until you are in a m ore secure location. | |
1563 | Face-to-Fa ce and Pho ne Convers ations | |
1564 | You are re sponsible for protec ting Veter ans’ priva cy and inf ormation i n all situ ations. Fo llow these guideline s to prote ct VA sens itive info rmation wh en you are having co nversation s in perso n or when using the phone. | |
1565 | In person: | |
1566 | ||
1567 | Discuss se nsitive in formation in private , such as in a priva te office | |
1568 | Close offi ce doors o r leave ar eas where others can overhear | |
1569 | ||
1570 | ||
1571 | Lower your voice whe n others a re around | |
1572 | Avoid talk ing about VA sensiti ve informa tion in lo bbies or e levators o r other pu blic place s | |
1573 | On the pho ne: | |
1574 | ||
1575 | Never give PII or PH I over the phone to someone yo u do not k now or who may not h ave the le gal author ity to rec eive it | |
1576 | Never leav e PII or P HI in a vo icemail | |
1577 | ||
1578 | More Infor mation | |
1579 | Face-to-fa ce or phon e conversa tions | |
1580 | ||
1581 | Be aware o f your sur roundings and be car eful what you say in face-to-f ace or pho ne convers ations to prevent di sclosing V A sensitiv e informat ion to any one who do esn’t need to know. | |
1582 | Discussing Veterans’ SPI over the phone or face-to -face in w aiting are as, hallwa ys, or ele vators sho uld never happen. Co nversation s, includi ng one sid e of a pho ne convers ation, can be overhe ard by any one passin g by. Be a ware of yo ur surroun dings and go to a pr ivate area for sensi tive conve rsations, and avoid revealing any VA sen sitive inf ormation u ntil you a re in a mo re secure location. | |
1583 | Rules of B ehavior | |
1584 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Sensiti ve Informa tion | |
1585 | I Will: | |
1586 | ||
1587 | Only provi de access to sensiti ve informa tion to th ose who ha ve a need- to-know fo r their pr ofessional duties, i ncluding o nly postin g sensitiv e informat ion to web - based co llaboratio n tools re stricted t o those wh o have a n eed-to-kno w and when proper sa feguards a re in plac e for sens itive info rmation. S OURCE: UL- 2 | |
1588 | Protect VA sensitive informati on from un authorized disclosur e, use, mo dification , or destr uction, an d will use encryptio n products approved and provid ed by VA t o protect sensitive data. SOUR CE: SC-13 | |
1589 | Securing E mail | |
1590 | Unencrypte d email me ssages can expose pr ivate info rmation. E mailed inf ormation i s more sec ure if it is encrypt ed. You mu st encrypt all email s and atta chments th at contain VA sensit ive inform ation. You can also use a digi tal signat ure to add another l evel of | |
1591 | ||
1592 | security t o your ema il message s. Adding a digital signature to an emai l allows t he recipie nt to veri fy the aut henticity and integr ity of the messages you send. | |
1593 | Always fol low the gu idelines a nd best pr actices wh en sending encrypted emails co ntaining V A sensitiv e informat ion. | |
1594 | VA uses tw o types of encryptio n to prote ct email: Secure/Mul tipurpose Internet M ail Extens ions (S/MI ME) encryp tion and A ctive Dire ctory Righ ts Managem ent Servic e (ADRMS) . VA-issue d computer s encrypt email thro ugh Micros oft Outloo k. Mobile devices, s uch as Bla ckBerry ph ones and i Phones, mu st have an encryptio n certific ate or an ADRMS clie nt install ed, which allows the device to send and receive en crypted em ails. | |
1595 | More Infor mation | |
1596 | Guidelines and pract ices when sending en crypted em ails | |
1597 | ||
1598 | Do not inc lude VA se nsitive in formation in the sub ject line | |
1599 | Include yo ur name an d phone nu mber in en crypted em ails | |
1600 | Confirm al l individu als on the distribut ion list a re approve d to recei ve the inf ormation | |
1601 | Consider t he audienc e carefull y before u sing Reply All for a n email | |
1602 | Be sure yo ur compute r’s settin gs have tu rned off t he feature to Auto F orward mes sages to a ddresses o utside of VA's netwo rk | |
1603 | S/MIME | |
1604 | ||
1605 | You may al so hear S/ MIME encry ption refe rred to as a Public Key Infras tructure ( PKI) certi ficate. Th is form of encryptio n prevents informati on in emai l messages and email attachmen ts from be ing read b y people w ho are not authorize d. It also provides authentica tion of th e sender i f the mess age is sig ned. S/MIM E works fo r both ext ernal and internal m essaging i f the reci pient also has a VA trusted PK I certific ate. | |
1606 | S/MIME doe s not encr ypt inform ation sent in the su bject line of an ema il. Never put VA sen sitive inf ormation i n the subj ect line o f an email . | |
1607 | If you hav e question s about ho w to use S /MIME, you can searc h for more training in the TMS or contac t the VA N ational Se rvice Desk . | |
1608 | ADRMS | |
1609 | ||
1610 | ADRMS, pre viously ca lled Right s Manageme nt Service (RMS), pr otects the content o f email me ssages, em ail attach ments, and other Mic rosoft Off ice® docum ents. ADRM S provides additiona l controls that S/MI ME does no t. ADRMS c an prevent forwardin g, | |
1611 | ||
1612 | copying, a nd Microso ft-provide d screen c aptures of RMS-prote cted conte nt. ADRMS works inte rnally and externall y if the e xternal us er is enro lled in th e VA ADRMS system. Y ou can req uest exter nal user a ccess to V A’s ADRMS system. | |
1613 | If you hav e question s about ho w to use A DRMS, you can search for more training i n the TMS or contact the VA Na tional Ser vice Desk. | |
1614 | Rules of B ehavior | |
1615 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Electro nic Data P rotection | |
1616 | I Will: | |
1617 | ||
1618 | Use VA e-m ail in the performan ce of my d uties and when issue d a VA ema il account . SOURCE: SC-8 | |
1619 | Only use d evices enc rypted wit h FIPS 140 -2 (or its successor ) validate d encrypti on. VA own ed and app roved stor age device s/media mu st use VA' s approved configura tion and s ecurity co ntrol requ irements. SOURCE: SC -28 | |
1620 | Obtain app roval prio r to publi c dissemin ation of V A informat ion via e- mail as ap propriate. SOURCE: S C-8 | |
1621 | I Will Not : | |
1622 | ||
1623 | Auto-forwa rd e-mail messages t o addresse s outside the VA net work. SOUR CE: SC-8 | |
1624 | Sensitive Informatio n | |
1625 | ||
1626 | I Will: | |
1627 | ||
1628 | Encrypt em ail, inclu ding attac hments, wh ich contai n VA sensi tive infor mation. SO URCE: SC-8 | |
1629 | I Will Not : | |
1630 | ||
1631 | Encrypt em ail that d oes not in clude VA s ensitive i nformation or any em ail exclud ed from th e encrypti on require ment. SOUR CE: SC-8 | |
1632 | Prohibited Use of Pe rsonal Ema il | |
1633 | According to VA Memo randum VAI Q #7581492 , Use of P ersonal Em ail, “the use of a p ersonal em ail accoun t or the u se of a pe rsonal ema il system to conduct official agency bus iness is n ot allowed .” Do not use your p ersonal em ail addres s to commu nicate abo ut | |
1634 | ||
1635 | VA busines s. When yo u use VA e mail, a co py is kept of all em ails and m akes it po ssible for VA to kee p track of business actions. | |
1636 | Rules of B ehavior | |
1637 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Electro nic Data P rotection | |
1638 | I Will: | |
1639 | ||
1640 | Comply wit h all fede ral VA inf ormation s ecurity, p rivacy, an d records management policies. SOURCE: P M-1 | |
1641 | Use VA e-m ail in the performan ce of my d uties and when issue d a VA ema il account . SOURCE: SC-8 | |
1642 | Obtain app roval prio r to publi c dissemin ation of V A informat ion via e- mail as ap propriate. SOURCE: S C-8 | |
1643 | Teleworkin g and Remo te Access | |
1644 | ||
1645 | I Will: | |
1646 | ||
1647 | Keep gover nment furn ished equi pment (GFE ) and VA i nformation safe, sec ure, and s eparated f rom my per sonal prop erty and i nformation , regardle ss of work location. SOURCE: A C-17 | |
1648 | Protect GF E from the ft, loss, destructio n, misuse, and emerg ing threat s. SOURCE: AC-17 | |
1649 | Sensitive Informatio n | |
1650 | ||
1651 | I Will Not : | |
1652 | ||
1653 | Allow VA s ensitive i nformation to reside on non-VA systems o r devices unless spe cifically designated and autho rized in a dvance by my VA supe rvisor, IS O, and Inf ormation S ystem Owne r, local C IO, or des ignee. SOU RCE: AC-20 | |
1654 | Electronic Calendar and Invita tions | |
1655 | Electronic calendars are helpf ul tools, but they c an expose VA sensiti ve informa tion. Do n ot enter V A sensitiv e informat ion into a Microsoft Outlook C alendar it em or meet ing invita tion Subje ct line be cause it d oes not ha ve the pro per securi ty control s. Any VA sensitive informatio n that you send for a meeting must be se nt by a se cure elect ronic form at, such a s encrypte d email. | |
1656 | Never use public ele ctronic ca lendars or scheduler s, such as Google or Yahoo cal endars, fo r VA busin ess. | |
1657 | ||
1658 | Public ele ctronic ca lendars ar e not VA-a pproved, d o not have adequate security, and can be more easi ly invaded by hacker s. | |
1659 | Rules of B ehavior | |
1660 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Sensiti ve Informa tion | |
1661 | I Will Not : | |
1662 | ||
1663 | Allow VA s ensitive i nformation to reside on non-VA systems o r devices unless spe cifically designated and autho rized in a dvance by my VA supe rvisor, IS O, and Inf ormation S ystem Owne r, local C IO, or des ignee. SOU RCE: AC-20 | |
1664 | ||
1665 | Knowledge Check: Ele ctronic Ca lendars an d Invitati ons | |
1666 | Consider t he followi ng questio n by selec ting the b est answer . | |
1667 | You are pl anning a m eeting to discuss a patient’s lab test r esults. Wh ich of the following examples protects P II or PHI in the sub ject line of an Outl ook meetin g invitati on? | |
1668 | Meeting wi th John Sm ith DOB: 0 1-30-75 | |
1669 | John Smith , 444 Cher ry Lane, c ancer trea tment | |
1670 | Mary Smith biopsy re sults | |
1671 | Meeting ab out patien t biopsy | |
1672 | The correc t answer i s D. Meeti ng about p atient bio psy. Do no t put PHI or PII in the subjec t line of a meeting invitation because i t does not have the proper sec urity cont rols. Alwa ys protect VA sensit ive inform ation in e lectronic communicat ion. | |
1673 | ||
1674 | Connecting Points | |
1675 | Here are t he connect ing points to recall so that y ou can saf ely share VA sensiti ve informa tion in ev eryday con versations and email s: | |
1676 | Protect in formation in convers ations and electroni c messages | |
1677 | Disclose V A sensitiv e informat ion only t o those wh o need to know | |
1678 | Encrypt me ssages and attachmen ts contain ing VA sen sitive inf ormation | |
1679 | Never incl ude VA sen sitive inf ormation i n electron ic calenda rs or emai l subject lines | |
1680 | ||
1681 | ||
1682 | Module 7: Handling P aper and E lectronic Documents | |
1683 | Objectives | |
1684 | VA sensiti ve informa tion can b e found in many type s of docum ents or me dia. You n eed to kno w how to k eep docume nts, recor ds, and fi les contai ning VA se nsitive in formation safe, whet her they a re in pape r or elect ronic form . | |
1685 | When you h ave comple ted this t opic, you will be ab le to: | |
1686 | ||
1687 | Recognize how to pro tect VA se nsitive in formation when handl ing paper documents, records, and files | |
1688 | Identify h ow to stor e safely, transport, and dispo se of any media cont aining VA sensitive informatio n | |
1689 | Making the Connectio n: Tanya’s Story | |
1690 | ||
1691 | ||
1692 | Mishandlin g Document s | |
1693 | While talk ing with t he clerk a t my docto r’s office , I placed my tablet on top of the count er. When I left, I a ccidentall y picked u p the docu mentation that the c lerk was w orking on along with my tablet . | |
1694 | That eveni ng I reali zed my mis take and r eturned th e document s the next morning. The clerk said she n oticed the documents were miss ing, but d idn’t know what had happened t o them. Sh e was reli eved that I had retu rned them, but still had to re port the m ishandled documents. | |
1695 | It is impo rtant to k eep VA sen sitive doc uments sec ure, espec ially in a public ar ea. Always maintaini ng a clean -desk poli cy helps t o ensure t hat docume nts are no t mishandl ed. | |
1696 | Requiremen ts for Han dling Pape r Document s | |
1697 | Improperly handling paper docu ments and files crea tes the ma jority of privacy an d informat ion securi ty inciden ts reporte d at VA ea ch year. B e sure you know the best pract ices for h andling do cuments, f iles, and federal re cords in p aper forma t. | |
1698 | Paper docu ments are familiar t o most of us. A few other spec ialty item s must als o be handl ed as if t hey are pa per docume nts. | |
1699 | ||
1700 | Every faci lity has d esignated individual s who admi nister or oversee th e VA Feder al Records Program i n their re spective a rea. | |
1701 | This role goes by ma ny names a cross VA a dministrat ions. We r efer to de signated r ecords man agement of ficials in this cour se to desc ribe those who have local over sight resp onsibiliti es to ensu re that fi le plans a re maintai ned. The d esignated records of ficial coo rdinates t he storage and dispo sition of records an d provides assistanc e with the local rec ords progr am. | |
1702 | More Infor mation | |
1703 | Paper docu ments and files | |
1704 | ||
1705 | Follow the se best pr actices to protect V A sensitiv e informat ion stored in paper documents and files: | |
1706 | Do not lea ve files o ut in area s such as public spa ces, priva te offices , conferen ce rooms, copy or fa x machines , mailboxe s, or wall trays | |
1707 | Lock files and docum ents in a drawer or cabinet wh en you are not in yo ur work ar ea | |
1708 | Get writte n permissi on from yo ur supervi sor, CIO, and ISO be fore you t ransport V A sensitiv e informat ion from V A location s | |
1709 | Always tra nsport VA sensitive informatio n in secur e containe rs or brie fcases | |
1710 | Maintain a clean-des k policy w here you e nsure you do not lea ve VA sens itive info rmation un attended o n your des k during t he day or when you l eave for t he day | |
1711 | Examples o f paper do cuments | |
1712 | ||
1713 | Some examp les of pap er documen ts include : | |
1714 | ||
1715 | Printouts of letters , reports, forms, or other con tent that was first created on a compute r | |
1716 | Copies mad e on a cop y machine | |
1717 | Fax transm issions se nt or rece ived | |
1718 | Handwritte n notes | |
1719 | Drawings | |
1720 | Magazines | |
1721 | Photos | |
1722 | Maps | |
1723 | ||
1724 | Rules of B ehavior | |
1725 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R | |
1726 | ||
1727 | Access and Use of VA Informati on Systems | |
1728 | ||
1729 | I Will: | |
1730 | ||
1731 | Comply wit h all fede ral VA inf ormation s ecurity, p rivacy, an d records management policies. SOURCE: P M-1 | |
1732 | Sensitive Informatio n | |
1733 | ||
1734 | I Will: | |
1735 | ||
1736 | Ensure tha t all prin ted materi al contain ing VA sen sitive inf ormation i s physical ly secured when not in use (e. g., locked cabinet, locked doo r). SOURCE : MP-4 | |
1737 | Transmit i ndividuall y identifi able infor mation via fax only when no ot her reason able means exist, an d when som eone is at the machi ne to rece ive the tr ansmission or the re ceiving ma chine is i n a secure location. SOURCE: S C-8 | |
1738 | Protect SP I aggregat ed in list s, databas es, or log books, and will incl ude only t he minimum necessary SPI to pe rform a le gitimate b usiness fu nction. SO URCE: SC-2 8 | |
1739 | Ensure fax transmiss ions are s ent to the appropria te destina tion. This includes double che cking the fax number , confirmi ng deliver y, using a fax cover sheet wit h the requ ired notif ication me ssage incl uded. SOUR CE: SC-8 | |
1740 | Records | |
1741 | Most paper documents or files may also b e federal records an d, if prop erly sched uled with NARA, will be identi fied in th e applicab le Records Control S chedule (R CS) or Gen eral Recor ds Schedul e (GRS). T hese recor ds must be available for use a s appropri ate as not ed in the applicable RCS and d isposed of properly. | |
1742 | More Infor mation | |
1743 | Using and storing pa per record s | |
1744 | ||
1745 | Use a noti ce sheet a s required before se nding pape r records to anyone. Refer to VA Directi ve 6609 fo r instruct ions on ma iling docu ments or f ederal rec ords conta ining SPI | |
1746 | Documents containing PHI must be sent us ing a HIPA A sealed e nvelope | |
1747 | Clearly ma rk any fol ders in st orage boxe s if they contain VA sensitive informati on. If you need to m ove federa l records to off-sit e storage, first con tact your designated records m anagement official. Be sure to clearly m ark transf er forms ( SF-135 or VA Form 02 44) when m oving reco rds that c ontain VA sensitive informatio n | |
1748 | ||
1749 | ||
1750 | Be sure fe deral reco rds that a re stored off-site a re listed on the wor k center’s file inve ntory. As long as fe deral reco rds are in the legal custody o f VA, desi gnated rec ords offic ials must maintain a ccess cont rol and se curity for records w ith VA sen sitive inf ormation i n them. Co ordinate w ith your d esignated records ma nagement o fficial if you are s toring or handling f ederal rec ords | |
1751 | Destroying or dispos ing of pap er records | |
1752 | ||
1753 | Ask your s upervisor or designa ted record s manageme nt officia l for guid ance befor e you disp ose of or destroy an y material that may be a feder al record. You can a lso consul t VA Direc tive 6300 and VA Han dbook 6300 .1 for gui dance. | |
1754 | Using pape r logbooks | |
1755 | ||
1756 | Paper logb ooks must not be use d unless y ou have pe rmission. To maintai n a paper logbook, y ou must ha ve an impo rtant busi ness need or legal r equirement and you m ust have i t approved by the Fa cility or Program Di rector | |
1757 | VA does no t allow th e use of p aper logbo oks for pe rsonal use . This inc ludes the use of pap er logbook s in clini cs and med ical cente rs. VHA st rongly dis courages a ny use of paper logb ooks | |
1758 | Logbooks w ith VA sen sitive inf ormation s hould be k ept in ele ctronic fi les on aut horized VA systems. If your jo b requires you to ma intain a l ogbook, us e an elect ronic logb ook if pos sible | |
1759 | If you fin d an old p aper logbo ok, contac t your loc al designa ted record s manageme nt officia l or Priva cy Officer to determ ine how to handle it . | |
1760 | Rules of B ehavior | |
1761 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Electro nic Data P rotection | |
1762 | I Will: | |
1763 | ||
1764 | Safeguard VA mobile devices an d portable storage d evices con taining VA informati on, at wor k and remo tely, usin g FIPS 140 -2 validat ed encrypt ion (or it s successo r) unless it is not technicall y possible . This inc ludes lapt ops, flash drives, a nd other r emovable s torage dev ices and s torage med ia (e.g., Compact Di scs (CD), Digital Vi deo Discs (DVD)). SO URCE: SC-1 3 | |
1765 | ||
1766 | Sensitive Informatio n | |
1767 | ||
1768 | I Will: | |
1769 | ||
1770 | Protect VA sensitive informati on from un authorized disclosur e, use, mo dification , or destr uction, an d will use encryptio n products approved and provid ed by VA t o protect sensitive data. SOUR CE: SC-13 | |
1771 | Faxing | |
1772 | The best p ractice fo r VA facil ities is t o only use a fax to transmit V A sensitiv e informat ion when a secure el ectronic t ransmissio n is not a vailable. | |
1773 | If you do use fax te chnology: | |
1774 | ||
1775 | Be sure to send faxe s from a l ocation th at is not public | |
1776 | Be sure yo ur recipie nt also ha s a secure location or someone is by the receiving machine t o collect the inform ation | |
1777 | Include a fax cover sheet with the follo wing infor mation: | |
1778 | ||
1779 | Recipient’ s name | |
1780 | Your name and contac t informat ion | |
1781 | Instructio ns for the recipient to verify fax recei pt | |
1782 | The follow ing statem ent should be used o n fax cove r sheets: | |
1783 | This fax i s intended only for the use of the perso n or offic e to which it is add ressed and may conta in informa tion that is privile ged, confi dential, o r protecte d by law. All others are hereb y notified that the receipt of this fax does not w aive any a pplicable privilege or exempti on for dis closure an d that any dissemina tion, dist ribution, or copying of this c ommunicati on is proh ibited. If you have received t his fax in error, pl ease notif y this off ice immedi ately at t he telepho ne number listed abo ve. | |
1784 | Rules of B ehavior | |
1785 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Sensiti ve Informa tion | |
1786 | I Will: | |
1787 | ||
1788 | Protect VA sensitive informati on from un authorized disclosur e, use, mo dification , or destr uction, an d will use encryptio n products approved and provid ed by VA t o protect sensitive data. SOUR CE: SC-13 | |
1789 | ||
1790 | ||
1791 | Transmit i ndividuall y identifi able infor mation via fax only when no ot her reason able means exist, an d when som eone is at the machi ne to rece ive the tr ansmission or the re ceiving ma chine is i n a secure location. SOURCE: S C-8 | |
1792 | Ensure fax transmiss ions are s ent to the appropria te destina tion. This includes double che cking the fax number , confirmi ng deliver y, using a fax cover sheet wit h the requ ired notif ication me ssage incl uded. SOUR CE: SC-8 | |
1793 | Mailings | |
1794 | VA sends t housands o f pieces o f mail to individual s and thou sands of b atches of form lette rs every w eek. It is a big cha llenge to get it rig ht every t ime. Many VA facilit ies also h ave a loca lly approv ed mail sy stem to tr ansfer pap er files a mong staff at the fa cility. | |
1795 | Each piece of intern al mail or U.S. mail must be h andled wit h a commit ment to pr otect sens itive info rmation. | |
1796 | More Infor mation | |
1797 | Internal o ffice mail services | |
1798 | ||
1799 | Place docu ments in c losed inte roffice en velopes | |
1800 | Place a No tice Sheet in the cl osed inter office env elope when contents include se nsitive in formation | |
1801 | Place docu ments with VA sensit ive inform ation in s ealed enve lopes insi de the int eroffice e nvelope fo r added sa fety. If y ou are sen ding PHI v ia interof fice mail, you are r equired to use a HIP AA sealed envelope | |
1802 | Include th e name of the recipi ent and ve rify his o r her mail center ad dress befo re sending | |
1803 | Distribute interoffi ce mail to the corre ct address es right a way | |
1804 | Transport VA sensiti ve informa tion in se cure conta iners or b riefcases | |
1805 | ||
1806 | Regular ma il or deli very servi ces | |
1807 | ||
1808 | When using the U.S. Postal Ser vice (USPS ) or other delivery services, keep this checklist in mind: | |
1809 | Pack envel opes, parc els, packa ges, and b oxes in a way that w ill preven t loss, ta mpering, o r unauthor ized acces s | |
1810 | Verify the person’s name on th e envelope matches t he person’ s name on the docume nts inside the envel ope | |
1811 | Confirm en velopes ar e securely sealed | |
1812 | Make sure mass-produ ced letter s and mail merges th at contain VA sensit ive inform ation are sealed pri or to deli very to th e approved shipping service | |
1813 | ||
1814 | ||
1815 | Check the recipient name and m ailing add ress | |
1816 | Confirm th at mailing labels an d window e nvelopes s how only t he recipie nt’s name and addres s and no o ther infor mation | |
1817 | Send origi nal docume nts and al l media th at contain VA sensit ive inform ation thro ugh a ship ping servi ce with tr acking cap abilities, such as U SPS, Unite d Parcel S ervice (UP S), or Fed Ex (Copies of docume nts contai ning VA se nsitive in formation may be sen t through the untrac ked USPS) | |
1818 | Rules of B ehavior | |
1819 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Sensiti ve Informa tion | |
1820 | I Will: | |
1821 | ||
1822 | Obtain app roval from my superv isor to us e, process , transpor t, transmi t, downloa d, print o r store el ectronic V A sensitiv e informat ion remote ly (outsid e of VA ow ned or man aged facil ities, e.g ., medical centers, community based outp atient cli nics (CBOC ), or regi onal offic es)). SOUR CE: UL-2 | |
1823 | Making the Connectio n: Sarah’s Story | |
1824 | ||
1825 | Handling P rescriptio n Mailings | |
1826 | Whenever I call to g et my pres cription r efilled, i t always s eems like the first time. I’ve noticed t hat they c arefully c ross-check my inform ation with what is i n the data base. | |
1827 | Because my address h ad changed , the phar macist ask ed a few a dditional questions to validat e my ident ity before mailing m y prescrip tions. | |
1828 | After the call, I co mpleted th e customer satisfact ion | |
1829 | survey. I am glad th ey are alw ays thorou gh by conf irming my informatio n each tim e my presc ription is issued. G etting the wrong pre scription could make me sick o r even put my life a t risk—and could giv e someone else my pe rsonal inf ormation. | |
1830 | VA’s mail order pres cription d rug servic e sends ou t millions of packag es each ye ar with ve ry few err ors. Sendi ng a presc ription to the wrong person wo uld expose a Veteran ’s persona l informat ion, and i t could al so be harm ful or eve n fatal to the recip ient. | |
1831 | ||
1832 | Consolidat ed Mail Ou tpatient P harmacy (C MOP) | |
1833 | In additio n to forms , letters, and other documents , VA also mails seve ral millio n prescrip tions and medication s to Veter ans each w eek throug h its Cons olidated M ail Outpat ient Pharm acy (CMOP) . If you h andle CMOP -related p ackages an d material s in your job, it is especiall y importan t to follo w mailing procedures precisely . | |
1834 | More Infor mation | |
1835 | VA has a t remendous record of very few e rrors in h andling CM OP mailing s. However , even one small mis take in ha ndling or mailing a CMOP packa ge is not only a sec urity and privacy vi olation, i t could al so be dama ging or ev en fatal t o the reci pient. Alw ays double -check the recipient s’ names a nd address es if you ever handl e CMOP pac kages and materials. | |
1836 | Rules of B ehavior | |
1837 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Sensiti ve Informa tion | |
1838 | I Will: | |
1839 | ||
1840 | Protect VA sensitive informati on from un authorized disclosur e, use, mo dification , or destr uction, an d will use encryptio n products approved and provid ed by VA t o protect sensitive data. SOUR CE: SC-13 | |
1841 | I Will Not : | |
1842 | ||
1843 | Disclose i nformation relating to the dia gnosis or treatment of drug ab use, alcoh olism or a lcohol abu se, HIV, o r sickle c ell anemia without a ppropriate legal aut hority. I understand unauthori zed disclo sure of th is informa tion may h ave a seri ous advers e effect o n agency o perations, agency as sets, or i ndividuals . SOURCE: IP-1 | |
1844 | Electronic Files | |
1845 | Many of us work with electroni c media or electroni c storage. If you wo rk for IT, you may a lso have r esponsibil ity for el ectronic i nformation systems. Privacy an d informat ion securi ty rules m ust be fol lowed when creating, storing, or disposi ng of elec tronic med ia and whe n accessin g electron ic files o r administ ering elec tronic inf ormation s ystems, su ch as Micr osoft Shar ePoint®. | |
1846 | Rules of B ehavior | |
1847 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R | |
1848 | ||
1849 | Electronic Data Prot ection | |
1850 | ||
1851 | I Will: | |
1852 | ||
1853 | Safeguard VA mobile devices an d portable storage d evices con taining VA informati on, at wor k and remo tely, usin g FIPS 140 -2 validat ed encrypt ion (or it s successo r) unless it is not technicall y possible . This inc ludes lapt ops, flash drives, a nd other r emovable s torage dev ices and s torage med ia (e.g., Compact Di scs (CD), Digital Vi deo Discs (DVD)). SO URCE: SC-1 3 | |
1854 | Only use d evices enc rypted wit h FIPS 140 -2 (or its successor ) validate d encrypti on. VA own ed and app roved stor age device s/media mu st use VA' s approved configura tion and s ecurity co ntrol requ irements. SOURCE: SC -28 | |
1855 | Sensitive Informatio n | |
1856 | ||
1857 | I Will: | |
1858 | ||
1859 | Only provi de access to sensiti ve informa tion to th ose who ha ve a need- to-know fo r their pr ofessional duties, i ncluding o nly postin g sensitiv e informat ion to web - based co llaboratio n tools re stricted t o those wh o have a n eed-to-kno w and when proper sa feguards a re in plac e for sens itive info rmation. S OURCE: UL- 2 | |
1860 | Protect VA sensitive informati on from un authorized disclosur e, use, mo dification , or destr uction, an d will use encryptio n products approved and provid ed by VA t o protect sensitive data. SOUR CE: SC-13 | |
1861 | Electronic Records | |
1862 | Just like paper file s and docu ments, ele ctronic fi les may be records. Be sure to also cons ult your d esignated records ma nagement o fficial be fore dispo sing of an y electron ic media, media stor age, or el ectronic i nformation systems t hat may be records. Records ma y not be d estroyed b efore the date noted in the RC S or GRS. Never dest roy record s without permission . All type s of elect ronic medi a, storage , or syste ms that ma y contain VA sensiti ve informa tion must be sanitiz ed or dest royed when no longer in use. | |
1863 | Ask your I SO for hel p with the sanitizat ion and di sposal or redistribu tion of el ectronic m edia. Here are some examples o f these it ems: | |
1864 | Electronic media: Em ails, Exce l and Acce ss spreads heets; JPE G, TIF, an d HTML fil es; flat f iles; Word documents , PDF docu ments | |
1865 | Electronic media sto rage: Magn etic tapes , floppy d isks, CDs/ DVDs, and external h ard drives | |
1866 | Electronic informati on systems : Concur G overnment Edition (C GE), VA el ectronic t ime and at tendance s ystem, VAT AS or WEB TA | |
1867 | ||
1868 | ||
1869 | 1. COVERAG E | |
1870 | ||
1871 | 1d. VA Inf ormation S ecurity RO B does not supersede any polic ies of VA facilities or other agency com ponents th at provide higher le vels of pr otection t o VA's inf ormation o r informat ion system s. The VA Informatio n Security ROB provi des the mi nimal rule s with whi ch individ ual users must compl y. Authori zed users are requir ed to go b eyond stat ed rules u sing "due diligence" and the h ighest eth ical stand ards. | |
1872 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
1873 | I Will: | |
1874 | ||
1875 | Comply wit h all fede ral VA inf ormation s ecurity, p rivacy, an d records management policies. SOURCE: P M-1 | |
1876 | I Will Not : | |
1877 | ||
1878 | Engage in any activi ty that is prohibite d by VA Di rective 60 01, Limite d Personal Use of Go vernment O ffice Equi pment Incl uding Info rmation Te chnology. SOURCE: AC -8 | |
1879 | Microsoft SharePoint | |
1880 | VA has app roved Micr osoft Shar ePoint for you to us e for onli ne data st orage and collaborat ion to sha re documen ts and fil es with th ose who ar e allowed to access them. Shar ePoint is found on t he VA Intr anet. | |
1881 | Your ISO, CIO, and P O can help you deter mine which types of informatio n can be s hared on s pecific Sh arePoint s ites. | |
1882 | Here are s ome tips t o protect VA sensiti ve informa tion on Sh arePoint: | |
1883 | ||
1884 | Share VA s ensitive i nformation only on s ites where access is limited t o individu als who ar e approved to access the infor mation | |
1885 | Request ac cess only for the si tes you ne ed to use to do your job | |
1886 | Share only the infor mation you r work uni t needs to share to do its job | |
1887 | Remove con tent from SharePoint periodica lly as it becomes ou tdated Pro tect recor ds stored on SharePo int in the se ways: | |
1888 | List the S harePoint sites in t he work un it’s file inventory | |
1889 | ||
1890 | ||
1891 | Ask your d esignated records ma nagement o fficial to schedule the dispos ition of t hese recor ds if they are unsch eduled | |
1892 | Consult wi th your de signated r ecords man agement of ficial pri or to dest roying any informati on that ma y be a rec ord stored in ShareP oint | |
1893 | Rules of B ehavior | |
1894 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Access and Use of VA Inform ation Syst ems | |
1895 | I Will: | |
1896 | ||
1897 | Comply wit h all fede ral VA inf ormation s ecurity, p rivacy, an d records management policies. SOURCE: P M-1 | |
1898 | Transporti ng VA Sens itive Info rmation | |
1899 | You must g et written permissio n from you r supervis or, CIO, a nd ISO bef ore you ca n remove a ny VA sens itive info rmation fr om a VA fa cility or office. Th ey must al so approve how the i nformation will be r emoved (i. e., electr onic or pa per format ) and how any electr onic devic es will be stored wh ile off-si te. | |
1900 | Rules of B ehavior | |
1901 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Electro nic Data P rotection | |
1902 | I Will: | |
1903 | ||
1904 | Safeguard VA mobile devices an d portable storage d evices con taining VA informati on, at wor k and remo tely, usin g FIPS 140 -2 validat ed encrypt ion (or it s successo r) unless it is not technicall y possible . This inc ludes lapt ops, flash drives, a nd other r emovable s torage dev ices and s torage med ia (e.g., Compact Di scs (CD), Digital Vi deo Discs (DVD)). SO URCE: SC-1 3 | |
1905 | Sensitive Informatio n | |
1906 | ||
1907 | I Will: | |
1908 | ||
1909 | Obtain app roval from my superv isor to us e, process , transpor t, transmi t, downloa d, print o r store el ectronic V A sensitiv e informat ion remote ly (outsid e of VA ow ned or man aged facil ities (e.g ., medical centers, community based outp atient cli nics (CBOC ), or regi onal offic es)). SOUR CE: UL-2 | |
1910 | ||
1911 | ||
1912 | Knowledge Check: Tra nsporting Informatio n | |
1913 | Consider t he followi ng questio n by selec ting the b est answer . | |
1914 | Who must g ive permis sion to re move VA se nsitive in formation from a VA facility o r office? | |
1915 | PM, Qualit y Manageme nt, or HR | |
1916 | HR, ISO, a nd System Administra tor | |
1917 | Supervisor , CIO, and ISO | |
1918 | Network Ad ministrato r, System Administra tor, or CI O | |
1919 | The correc t answer i s C. You m ust get wr itten perm ission fro m your sup ervisor, C IO, and IS O before y ou can rem ove any VA sensitive informati on from a VA facilit y or offic e. They mu st also ap prove how the inform ation will be remove d and how any electr onic devic es will be stored wh ile off-si te. | |
1920 | ||
1921 | Connecting Points | |
1922 | Here are t he connect ing points to recall when hand ling docum ents and f iles: | |
1923 | ||
1924 | Protect VA sensitive informati on when ha ndling doc uments and files | |
1925 | Prevent mi smailing b y followin g procedur es and che cking reci pients and addresses are corre ct | |
1926 | Use only a pproved me thods to s tore or tr ansport el ectronic d ocuments | |
1927 | ||
1928 | ||
1929 | Module 8. Recognizin g and Repo rting Inci dents | |
1930 | Objectives | |
1931 | Throughout this cour se, we've shown you examples o f threats and risks to VA priv acy and se curity and tips for preventing privacy o r informat ion securi ty inciden ts. But wh at do you do if prev ention doe sn’t work? What if y ou suspect a rules v iolation i s putting informatio n at risk in your wo rk team? W hat if you get an em ail from a n external source cl aiming to be an ISO asking for personal informatio n? Who do you contac t if you s uspect som eone has t ried to ac cess your VA-issued laptop? | |
1932 | When you h ave comple ted this t opic, you will be ab le to: | |
1933 | ||
1934 | Identify p rivacy and informati on securit y incident s | |
1935 | Recall how to report suspected privacy a nd informa tion secur ity incide nts | |
1936 | ||
1937 | What Are I ncidents? | |
1938 | Incidents are define d as actua l or poten tial priva cy and inf ormation s ecurity vi olations. The threat s and risk s that wer e describe d in previ ous topics are situa tions that can resul t in incid ents. VA t akes all i ncident re ports seri ously, eve n if they are only s uspected i ncidents. | |
1939 | Examples o f suspecte d incident s that sho uld be rep orted incl ude: | |
1940 | ||
1941 | Finding a folder tha t contains VA sensit ive papers on a copi er | |
1942 | Finding tw o loose ma iling labe ls on the ground tha t are addr essed to p atients | |
1943 | Receiving a call fro m a Vetera n that his CMOP pack age contai ned the wr ong amount of pills | |
1944 | Seeing som eone you d o not reco gnize acce ssing a VA system | |
1945 | Receiving an unencry pted email with PHI from a cow orker | |
1946 | Finding a coworker’s PIV card | |
1947 | ||
1948 | Incidents that threa ten privac y and secu rity affec t VA, Vete rans, and you. | |
1949 | ||
1950 | More Infor mation | |
1951 | Examples o f the impa ct | |
1952 | ||
1953 | Veterans m ay be harm ed if thei r Sensitiv e Personal Informati on is made public; t hey could have a fin ancial los s, loss of privacy, loss of be nefits, em otional di stress, or possibly even ident ity theft | |
1954 | If you vio late the R OB resulti ng in an i ncident, y ou could f ace job lo ss, fines, and possi bly prison if there is great h arm caused by the vi olation | |
1955 | ||
1956 | ||
1957 | VA may los e the publ ic’s trust | |
1958 | VA may hav e to repor t the inci dent to Co ngress, es pecially i f the inci dent is an informati on data br each affec ting a lar ge number of Veteran s | |
1959 | VA resourc es that co uld be spe nt to serv e Veterans must be s pent inste ad to corr ect mistak es | |
1960 | Certain ki nds of inc idents cou ld threate n our nati onal secur ity | |
1961 | ||
1962 | Rules of B ehavior | |
1963 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Inciden t Reportin g | |
1964 | I Will: | |
1965 | ||
1966 | Report sus pected or identified informati on securit y incident s includin g anti-vir us, antisp yware, fir ewall or i ntrusion d etection s oftware er rors, or s ignificant alert mes sages (sec urity and privacy) t o my VA su pervisor o r designee immediate ly upon su spicion. S OURCE: IR- 6 | |
1967 | Consequenc es if You Cause an I ncident | |
1968 | It makes a differenc e whether an inciden t is accid ental or i ntentional . The cons equences f or intenti onal acts are more s evere than the conse quences fo r accident s. | |
1969 | Serious co nsequences of privac y and info rmation se curity vio lations co uld includ e: | |
1970 | ||
1971 | Suspension of your a ccess to s ystems | |
1972 | A repriman d in your personnel file | |
1973 | Suspension from your job, demo tion, or j ob loss | |
1974 | Prosecutio n in civil or crimin al courts | |
1975 | Fines | |
1976 | Imprisonme nt | |
1977 | ||
1978 | Rules of B ehavior | |
1979 | 2. COMPLIA NCE | |
1980 | ||
1981 | 2a. Non-co mpliance w ith VA ROB may be ca use for di sciplinary actions. Depending on the sev erity of t he violati on and man agement di scretion, consequenc es may inc lude restr icting acc ess, suspe nsion of a ccess priv ileges, re primand, d emotion an d suspensi on from wo rk. Theft, conversio n, or unau thorized d isposal or destructi on of Fede ral proper ty or info rmation ma y result i n criminal sanctions . | |
1982 | ||
1983 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R Inciden t Reportin g | |
1984 | I Will: | |
1985 | ||
1986 | Report sus pected or identified informati on securit y incident s includin g anti-vir us, antisp yware, fir ewall or i ntrusion d etection s oftware er rors, or s ignificant alert mes sages (sec urity and privacy) t o my VA su pervisor o r designee immediate ly upon su spicion. S OURCE: IR- 6 | |
1987 | Severe Pen alties | |
1988 | If you ste al, change , or destr oy federal property or informa tion, you could face many pena lties unde r various laws, such as: | |
1989 | Fines of u p to $250, 000 | |
1990 | Prison for up to 10 years Othe r penaltie s | |
1991 | Penalties for mishan dling reco rds: The m aximum pen alty for t he willful and unlaw ful destru ction, dam age, or al ienation o f federal records is a $2,000 fine, 3 ye ars in pri son, or bo th | |
1992 | Penalties for violat ing the Pr ivacy Act: You can f ace up to $5,000 in fines and a year in prison | |
1993 | Penalties for HIPAA violations : You can face fines from $100 to $1.5 m illion and potential jail time | |
1994 | More penal ties may a pply for v iolating l aws protec ting PHI | |
1995 | ||
1996 | More Infor mation | |
1997 | Penalties | |
1998 | ||
1999 | These pena lties are defined in 36 Code o f Federal Regulation (CFR) § 1 228.102. | |
2000 | ||
2001 | Rules of B ehavior | |
2002 | COMPLIANCE | |
2003 | ||
2004 | 2a. Non-co mpliance w ith VA ROB may be ca use for di sciplinary actions. Depending on the sev erity of t he violati on and man agement di scretion, consequenc es may inc lude restr icting acc ess, suspe nsion of a ccess priv ileges, re primand, d emotion an d suspensi on from wo rk. Theft, conversio n, or unau thorized d isposal or destructi on of Fede ral proper ty or info rmation ma y result i n criminal sanctions . | |
2005 | ||
2006 | Making the Connectio n: Dr. Saw yer’s Stor y | |
2007 | ||
2008 | ||
2009 | Reporting a Policy V iolation | |
2010 | Yesterday when I lef t work at the VA med ical cente r, I saw a stack of computer p rintouts s itting nex t to a dum pster. The re were li sts of pat ient names and addre sses in th at stack. | |
2011 | I immediat ely report ed it as a n incident . I took t he box and delivered it to the VA securi ty officer at the se curity des k in the l obby. He t ook it fro m there. I ’m glad I was able t o connect with someo ne who kne w how to h andle the situation. | |
2012 | Taking act ion when y ou see pos sible inci dents can prevent ma jor conseq uences. | |
2013 | Steps for Reporting Suspected Incidents | |
2014 | If you not ice anythi ng that ma y put VA s ensitive i nformation or inform ation syst ems at ris k, report it. | |
2015 | Step 1. No te the det ails. What happened? Where did it happen ? When did it happen ? Who was involved? Why do you think it might be a rules vio lation? | |
2016 | Step 2. Re port it: | |
2017 | ||
2018 | Employees: Report su spected or identifie d incident s to your supervisor and ISO o r PO immed iately. If you do no t know the name of y our ISO or PO, you c an check t he locator link prov ided in th e Resource s section. If you wo rk in VHA, you can a lso report incidents to your A dministrat or of the Day (AOD) | |
2019 | Contractor s: Report every inci dent to yo ur ISO or PO and als o to your COR and Pr oject Mana ger. All s uspected o r identifi ed inciden ts must be reported immediatel y | |
2020 | More Infor mation | |
2021 | Your ISO o r PO must report the incident to VA NSOC within on e hour of being disc overed or reported. | |
2022 | Report to NSOC by ca lling the VA Nationa l Service Desk (see the Resour ces sectio n for cont act inform ation). | |
2023 | Rules of B ehavior | |
2024 | 4. INFORMA TION SECUR ITY RULES of BEHAVIO R | |
2025 | ||
2026 | Incident R eporting | |
2027 | ||
2028 | I Will: | |
2029 | ||
2030 | Report sus pected or identified informati on securit y incident s includin g anti-vir us, antisp yware, fir ewall or i ntrusion d etection s oftware er rors, or s ignificant alert mes sages (sec urity and privacy) t o my VA su pervisor o r designee immediate ly upon su spicion. S OURCE: IR- 6 | |
2031 | ||
2032 | Knowledge Check: Ste ps for Rep orting Sus pected Inc idents | |
2033 | Consider t he followi ng questio n by selec ting the b est answer . | |
2034 | To whom ca n you repo rt if you witness a suspected incident? | |
2035 | ||
2036 | Your super visor and ISO (or CO R and Proj ect Manage r if you a re a contr actor) | |
2037 | Your PO | |
2038 | NSOC throu gh the VA National S ervice Des k | |
2039 | Any of the above | |
2040 | The correc t answer i s D. Any o f the abov e. Report suspected or identif ied incide nts to you r supervis or and ISO , PO, or N SOC throug h the VA N ational Se rvice Desk . If you a re a contr actor, als o report i ncidents t o your COR and Proje ct Manager . If you n otice anyt hing that may put VA sensitive informati on or info rmation sy stems at r isk, repor t it. | |
2041 | ||
2042 | Other Reso urces to R eport Inci dents | |
2043 | If you are unable to report an incident to your su pervisor, ISO, PO, o r VHA Admi nistrative Officer o f the Day (AOD), her e are some more reso urces: | |
2044 | To report security i ncidents d irectly to VA NSOC, contact th e VA Natio nal Servic e Desk | |
2045 | If you sus pect an un ethical or criminal act is occ urring, co ntact loca l VA polic e, the VA Office of Inspector General (O IG), and y our superv isor (or C OR), ISO, and/or PO | |
2046 | If you sus pect fraud , waste, o r mismanag ement of r esources, contact th e VA OIG | |
2047 | If you sus pect your supervisor is involv ed in the incident, report the incident to your IS O and/or P O | |
2048 | Connecting Points | |
2049 | Here are t he connect ing points to recall to help y ou when re porting in cidents: | |
2050 | ||
2051 | Report any suspected or identi fied incid ent right away | |
2052 | ||
2053 | ||
2054 | Report sus pected or identified incidents to your s upervisor (or COR) a nd ISO or PO | |
2055 | Report an incident d irectly to NSOC by c ontacting the VA Nat ional Serv ice Desk, if your su pervisor o r COR, ISO , and/or P O are not available | |
2056 | Never be a fraid to r eport an i ncident. A ny time yo u hear or see someth ing of con cern, repo rt it imme diately. | |
2057 | ||
2058 | ||
2059 | Module 9. Course Sum mary and R ules of Be havior | |
2060 | Course Sum mary | |
2061 | Privacy an d informat ion securi ty policie s, guideli nes, and b est practi ces are he re to help protect y ou, VA, Ve terans, an d their fa milies. To protect p rivacy and ensure in formation security, remember t o: | |
2062 | Protect VA sensitive informati on | |
2063 | Recognize how techno logies and applicati ons can co mpromise V A sensitiv e informat ion | |
2064 | Prevent at tacks on i nformation systems a nd network s | |
2065 | Take preca utions to prevent th eft or los s of VA-is sued elect ronic devi ces | |
2066 | Take care with priva te convers ations and messaging | |
2067 | Handle pap er and ele ctronic do cuments an d records safely | |
2068 | Recognize and report incidents | |
2069 | ||
2070 | Acknowledg e, Accept, and Compl y With the ROB | |
2071 | Your last step to co mplete thi s course i s to revie w, sign, a nd accept the Rules of Behavio r. | |
2072 | Working fo r VA, you may access and use V A informat ion system s or you m ay come in contact w ith VA sen sitive inf ormation. This means you must accept res ponsibilit y for prot ecting pri vacy and e nsuring in formation security. The ROB ar e the mini mum compli ance stand ards for V A personne l in all l ocations. If your lo cation has rules tha t are stri cter than the Inform ation Secu rity rules , you must obey them . You must complete training a nd formall y acknowle dge, accep t, and com ply with t he ROB eac h year to receive an d retain a ccess to V A sensitiv e informat ion or inf ormation s ystems. | |
2073 | Read all o f the ROB closely. B y acceptin g and ackn owledging the ROB, y ou are agr eeing to u phold all of the beh aviors sta ted in the rules. Ma ny, but no t all, of the ROB ha ve been ex plained in this cour se. | |
2074 | To complet e this tra ining, you must init ial and si gn the ROB . | |
2075 | ||
2076 | Instructio ns for Sig ning the R ules of Be havior | |
2077 | In order t o complete the signa ture step, first pri nt the ROB document, Appendix A: VA Info rmation Se curity Rul es of Beha vior. | |
2078 | To acknowl edge and a ccept the ROB: | |
2079 | ||
2080 | Initial ea ch printed page with your init ials where indicated | |
2081 | ||
2082 | ||
2083 | Sign the l ast page o f the docu ment where indicated | |
2084 | ||
2085 | Submitting Your Sign ed ROB | |
2086 | Once you h ave comple ted initia ling and s igning the ROB docum ent, you m ust submit the signe d document to your s upervisor or designe e for docu mentation of course completion . | |
2087 | Course Com pletion | |
2088 | Congratula tions! Whe n you have signed an d submitte d the ROB, you have successful ly complet ed the VA Privacy an d Informat ion Securi ty Awarene ss and Rul es of Beha vior train ing. | |
2089 | Now that y ou have co mpleted th is course, you shoul d be able to: | |
2090 | ||
2091 | Identify t he types o f informat ion that m ust be han dled caref ully to pr otect priv acy | |
2092 | Describe w hat you ar e required to do to protect pr ivacy when handling VA sensiti ve informa tion | |
2093 | Describe w hat you ar e required to do to protect pr ivacy when using ele ctronic de vices | |
2094 | Recognize privacy an d informat ion securi ty laws an d the pena lties for non- compl iance | |
2095 | Explain th e process for report ing incide nts. | |
2096 | ||
2097 | You should now be pr epared to protect pr ivacy, ens ure the se curity of VA sensiti ve informa tion, and comply wit h the Rule s of Behav ior. | |
2098 | Rules of B ehavior | |
2099 | 3. ACKNOWL EDGE | |
2100 | ||
2101 | 3a. VA Inf ormation S ecurity RO B must be signed bef ore access is provid ed to VA i nformation systems o r VA infor mation. Th e VA ROB m ust be sig ned annual ly by all users of V A informat ion system s or VA in formation. This sign ature indi cates agre ement to a dhere to t he VA ROB. Refusal t o sign VA Informatio n Security ROB will result in denied acc ess to VA informatio n systems or VA info rmation. A ny refusal to sign t he VA Info rmation Se curity ROB may have an adverse impact on employmen t with VA. | |
2102 | ||
2103 | ||
2104 | APPENDIX A : Departme nt of Vete ran Affair s Informat ion Securi ty Rules o f Behavior | |
2105 | COVERAGE | |
2106 | ||
2107 | Department of Vetera ns Affairs (VA) Info rmation Se curity Rul es of Beha vior (ROB) provides the specif ic respons ibilities and expect ed behavio r for orga nizational users and non-organ izational users of V A systems and VA inf ormation a s required by 0MB Ci rcular A-1 30, Append ix Ill, pa ragraph 3a (2)(a) and VA Handbo ok 6500, M anaging In formation Security R isk: VA In formation Security P rogram. | |
2108 | Organizati onal users are ident ified as V A employee s, contrac tors, rese archer, st udents, vo lunteers, and repres entatives of Federal , state, l ocal or tr ibal agenc ies. | |
2109 | Non-organi zational u sers are i dentified as all inf ormation s ystem user s other th an VA user s explicit ly categor ized as or ganization al users. | |
2110 | VA Informa tion Secur ity ROB do es not sup ersede any policies of VA faci lities or other agen cy compone nts that p rovide hig her levels of protec tion to VA 's informa tion or in formation systems. T he VA Info rmation Se curity ROB provides the minima l rules wi th which i ndividual users must comply. A uthorized users are required t o go beyon d stated r ules using "due dili gence" and the highe st ethical standards . | |
2111 | COMPLIANCE | |
2112 | ||
2113 | Non-compli ance with VA ROB may be cause for discip linary act ions. Depe nding on t he severit y of the v iolation a nd managem ent discre tion, cons equences m ay include restricti ng access, suspensio n of acces s privileg es, reprim and, demot ion and su spension f rom work. Theft, con version, o r unauthor ized dispo sal or des truction o f Federal property o r informat ion may re sult in cr iminal san ctions. | |
2114 | Unauthoriz ed accessi ng, upload ing, downl oading, ch anging, ci rcumventin g, or dele ting of in formation on VA syst ems; unaut horized mo difying VA systems, denying or granting access to VA systems ; using VA resources for unaut horized us e on VA sy stems; or otherwise misusing V A systems or resourc es is stri ctly prohi bited. | |
2115 | VA Informa tion Secur ity Rules of Behavio r (ROB) do es not cre ate any ot her right or benefit , substant ive or pro cedural, e nforceable by law, b y a party in litigat ion with t he U.S. Go vernment. | |
2116 | ||
2117 | ||
2118 | ||
2119 | ||
2120 | ACKNOWLEDG EMENT | |
2121 | ||
2122 | VA Informa tion Secur ity ROB mu st be sign ed before access is provided t o VA infor mation sys tems or VA informati on. The VA ROB must be signed annually b y all user s of VA in formation systems or VA inform ation. Thi s signatur e indicate s agreemen t to adher e to the V A ROB. Ref usal to si gn VA Info rmation Se curity ROB will resu lt in deni ed access to VA info rmation sy stems or V A informat ion. Any refusal to sign the VA Informa tion Secur ity ROB ma y have an adverse im pact on em ployment w ith VA. | |
2123 | The ROB ma y be signe d in hard copy or el ectronical ly. If sig ned using the hard c opy method , the user should in itial and date each page and p rovide the informati on request ed under A cknowledge ment and A cceptance. For Other Federal G overnment Agency use rs, docume ntation of a signed ROB will b e provided to the VA requestin g official . | |
2124 | INFORMATIO N SECURITY RULES of BEHAVIOR Access and Use of VA Informati on Systems | |
2125 | I Will: | |
2126 | ||
2127 | Comply wit h all fede ral VA inf ormation s ecurity, p rivacy, an d records management policies. SOURCE: P M-1 | |
2128 | Have NO ex pectation of privacy in any re cords that I create or in my a ctivities while acce ssing or u sing VA in formation systems. S OURCE: AC- 8 | |
2129 | Use only V A-approved devices, systems, s oftware, s ervices, a nd data wh ich I am a uthorized to use, in cluding co mplying wi th any sof tware lice nsing or c opyright r estriction s. SOURCE: AC-6 | |
2130 | Follow est ablished p rocedures for reques ting acces s to any V A computer system an d for noti fying my V A supervis or or desi gnee when the access is no lon ger needed . SOURCE: AC-2 | |
2131 | Only use m y access t o VA compu ter system s and/or r ecords for officiall y authoriz ed and ass igned duti es. SOURCE : AC-6 | |
2132 | Log out of all infor mation sys tems at th e end of e ach workda y. SOURCE: AC-11 | |
2133 | Log off or lock any VA compute r or conso le before walking aw ay. SOURCE : AC- 11 | |
2134 | Only use o ther Feder al governm ent inform ation syst ems as exp ressly aut horized by the terms of those systems; p ersonal us e is prohi bited. SOU RCE: AC-20 | |
2135 | ||
2136 | ||
2137 | Only use V A-approved solutions for conne cting non- VA-owned s ystems to VA's netwo rk. SOURCE : AC-20 | |
2138 | I Will Not : | |
2139 | ||
2140 | Attempt to probe com puter syst ems to exp loit syste m controls or to obt ain unauth orized acc ess to VA sensitive data. SOUR CE: AC-6 | |
2141 | Engage in any activi ty that is prohibite d by VA Di rective 60 01, Limite d Personal Use of Go vernment O ffice Equi pment Incl uding Info rmation Te chnology. SOURCE: AC -8 | |
2142 | Have a VA network co nnection a nd a non-V A network connection (includin g a modem or phone l ine or wir eless netw ork card, etc.) phys ically con nected to any device at the sa me time un less the d ual connec tion is ex plicitly a uthorized. SOURCE: A C-17 (k) | |
2143 | Host, set up, admini ster, or o perate any type of I nternet se rver or wi reless acc ess point on any VA network un less expli citly auth orized by my Informa tion Syste m Owner, l ocal CIO, or designe e and appr oved by my ISO. SOUR CE: AC-18 | |
2144 | Protection of Comput ing Resour ces | |
2145 | ||
2146 | I Will: | |
2147 | ||
2148 | Secure mob ile device s and port able stora ge devices (e.g., la ptops, Uni versal Ser ial Bus (U SB) flash drives, sm artphones, tablets, personal d igital ass istants (P DA)). SOUR CE: AC-19 | |
2149 | I Will Not : | |
2150 | ||
2151 | Swap or su rrender VA hard driv es or othe r storage devices to anyone ot her than a n authoriz ed 01&T em ployee. SO URCE: MP-4 | |
2152 | Attempt to override, circumven t, alter o r disable operationa l, technic al, or man agement se curity con figuration controls unless exp ressly dir ected to d o so by au thorized V A staff. S OURCE: CM- 3 | |
2153 | Electronic Data Prot ection | |
2154 | ||
2155 | I Will: | |
2156 | ||
2157 | Only use v irus prote ction soft ware, anti -spyware, and firewa ll/intrusi on detecti on softwar e authoriz ed by VA. SOURCE: Sl -3 | |
2158 | Safeguard VA mobile devices an d portable storage d evices con taining VA informati on, at wor k and remo tely, usin g FIPS 140 -2 validat ed encrypt ion (or it s | |
2159 | ||
2160 | successor) unless it is not te chnically possible. This inclu des laptop s, flash d rives, and other rem ovable sto rage devic es and sto rage media (e.g., Co mpact Disc s (CD), Di gital Vide o Discs (D VD)). SOUR CE: SC-13 | |
2161 | Only use d evices enc rypted wit h FIPS 140 -2 (or its successor ) validate d encrypti on. VA own ed and app roved stor age device s/media mu st use VA' s approved configura tion and s ecurity co ntrol requ irements. SOURCE: SC -28 | |
2162 | Use VA e-m ail in the performan ce of my d uties when issued a VA email a ccount. SO URCE: SC-8 | |
2163 | Obtain app roval prio r to publi c dissemin ation of V A informat ion via e- mail as ap propriate. SOURCE: S C-8 | |
2164 | I Will Not : | |
2165 | ||
2166 | Transmit V A sensitiv e informat ion via wi reless tec hnologies unless the connectio n uses FIP S 140-2 (o r its succ essor) val idated enc ryption. S OURCE: AC- 18 | |
2167 | Auto-forwa rd e-mail messages t o addresse s outside the VA net work. SOUR CE: SC-8 | |
2168 | Download s oftware fr om the Int ernet, or other publ ic availab le sources , offered as free tr ials, shar eware; or other unli censed sof tware to a VA-owned system. SO URCE: CM-1 1 | |
2169 | Disable or degrade s oftware pr ograms use d by VA th at install security software u pdates to VA compute r equipmen t, to comp uter equip ment used to connect to VA inf ormation s ystems, or used to c reate, sto re or use VA informa tion. SOUR CE: CM-10 | |
2170 | Teleworkin g and Remo te Access | |
2171 | ||
2172 | I Will: | |
2173 | ||
2174 | Keep gover nment furn ished equi pment (GFE ) and VA i nformation safe, sec ure, and s eparated f rom my per sonal prop erty and i nformation , regardle ss of work location. I will pr otect GFE from theft , loss, de struction, misuse, a nd emergin g threats. SOURCE: A C-17 | |
2175 | Obtain app roval prio r to using remote ac cess capab ilities to connect n on-GFE equ ipment to VA's netwo rk while w ithin the VA facilit y. SOURCE: AC-17 | |
2176 | Notify my VA supervi sor or des ignee prio r to any i nternation al travel with a GFE mobile de vice (e.g. laptop, P DA) and up on return, including potential ly issuing a specifi cally conf igured dev ice for in ternationa l travel a nd/or insp ecting the device or reimaging the hard drive upon return. S OURCE: AC- 17 | |
2177 | ||
2178 | ||
2179 | Safeguard VA sensiti ve informa tion, in a ny format, device, s ystem and/ or softwar e in remot e location s (e.g., a t home and during tr avel). SOU RCE: AC-17 | |
2180 | Provide au thorized O l&T person nel access to inspec t the remo te locatio n pursuant to an app roved tele work agree ment that includes a ccess to V A sensitiv e informat ion. SOURC E: AC-17 | |
2181 | Protect in formation about remo te access mechanisms from unau thorized u se and dis closure. S OURCE: AC- 17 | |
2182 | Exercise a higher le vel of awa reness in protecting GFE mobil e devices when trave ling inter nationally as laws a nd individ ual rights vary by c ountry and threats a gainst Fed eral emplo yee device s may be h eightened. SOURCE: A C-19 | |
2183 | I Will Not : | |
2184 | ||
2185 | Access non -public VA informati on technol ogy resour ces from p ublicly-av ailable IT computers , such as remotely c onnecting to the int ernal VA n etwork fro m computer s in a pub lic librar y. SOURCE: AC-17 | |
2186 | Access VA' s internal network f rom any fo reign coun try design ated as su ch unless approved b y my VA su pervisor, ISO, local CIO, and Informatio n System O wner. SOUR CE: AC-17 | |
2187 | User Accou ntability | |
2188 | ||
2189 | I Will: | |
2190 | ||
2191 | Complete m andatory s ecurity an d privacy awareness training w ithin desi gnated tim e frames, and comple te any add itional ro le-based s ecurity tr aining req uired base d on my ro le and res ponsibilit ies. SOURC E: AT-3 | |
2192 | Understand that auth orized VA personnel may review my conduc t or actio ns concern ing VA inf ormation a nd informa tion syste ms, and ta ke appropr iate actio n. SOURCE: AU-1 | |
2193 | Have my GF E scanned and servic ed by VA a uthorized personnel. This may require me to return it prompt ly to a VA facility upon deman d. SOURCE: MA-2 | |
2194 | Permit onl y those au thorized b y Ol&T to perform ma intenance on IT comp onents, in cluding in stallation or remova l of hardw are or sof tware. SOU RCE: MA-5 | |
2195 | Sign speci fic or uni que ROBs a s required for acces s or use o f specific VA system s. I may b e required to comply with a no n-VA entit y's ROB to conduct V A business . While us ing their system, I must compl y with the ir ROB. SO URCE: PL- 4 | |
2196 | ||
2197 | Sensitive Informatio n | |
2198 | ||
2199 | I Will: | |
2200 | ||
2201 | Ensure tha t all prin ted materi al contain ing VA sen sitive inf ormation i s physical ly secured when not in use (e. g., locked cabinet, locked doo r). SOURCE : MP-4 | |
2202 | Only provi de access to sensiti ve informa tion to th ose who ha ve a need- to-know fo r their pr ofessional duties, i ncluding o nly postin g sensitiv e informat ion to web - based co llaboratio n tools re stricted t o those wh o have a n eed-to-kno w and when proper sa feguards a re in plac e for sens itive info rmation. S OURCE: UL- 2 | |
2203 | Recognize that acces s to certa in databas es have th e potentia l to cause great ris k to VA, i ts custome rs and emp loyees due to the nu mber and/o r sensitiv ity of the records b eing acces sed. I wil l act acco rdingly to ensure th e confiden tiality an d security of these data comme nsurate wi th this in creased po tential ri sk. SOURCE : UL-2 | |
2204 | Obtain app roval from my superv isor to us e, process , transpor t, transmi t, downloa d, print o r store el ectronic V A sensitiv e informat ion remote ly (outsid e of VA ow ned or man aged facil ities (e.g ., medical centers, community based outp atient cli nics (CBOC ), or regi onal offic es)). SOUR CE: UL-2 | |
2205 | Protect VA sensitive informati on from un authorized disclosur e, use, mo dification , or destr uction, an d will use encryptio n products approved and provid ed by VA t o protect sensitive data. SOUR CE: SC-13 | |
2206 | Transmit i ndividuall y identifi able infor mation via fax only when no ot her reason able means exist, an d when som eone is at the machi ne to rece ive the tr ansmission or the re ceiving ma chine is i n a secure location. SOURCE: S C-8 | |
2207 | Encrypt em ail, inclu ding attac hments, wh ich contai n VA sensi tive infor mation. SO URCE: SC-8 | |
2208 | Protect SP I aggregat ed in list s, databas es, or log books, and will incl ude only t he minimum necessary SPI to pe rform a le gitimate b usiness fu nction. SO URCE: SC-2 8 | |
2209 | Ensure fax transmiss ions are s ent to the appropria te destina tion. This includes double che cking the fax number , confirmi ng deliver y, using a fax cover sheet wit h the requ ired notif ication me ssage incl uded. SOUR CE: SC-8 | |
2210 | I Will Not : | |
2211 | ||
2212 | Disclose i nformation relating to the dia gnosis or treatment of drug ab use, alcoh olism or a lcohol abu se, HIV, o r sickle c ell anemia without a ppropriate legal aut hority. I understand unauthori zed disclo sure of th is informa tion may h ave a | |
2213 | ||
2214 | serious ad verse effe ct on agen cy operati ons, agenc y assets, or individ uals. SOUR CE: IP-1 | |
2215 | Allow VA s ensitive i nformation to reside on non-VA systems o r devices unless spe cifically designated and autho rized in a dvance by my VA supe rvisor, IS O, and Inf ormation S ystem Owne r, local C IO, or des ignee. SOU RCE: AC-20 | |
2216 | Make any u nauthorize d disclosu re of any VA sensiti ve informa tion throu gh any mea ns of comm unication including, but not l imited to, e-mail, i nstant mes saging, on line chat, and web b ulletin bo ards or lo gs. SOURCE : SC-8 | |
2217 | Encrypt em ail that d oes not in clude VA s ensitive i nformation or any em ail exclud ed from th e encrypti on require ment. SOUR CE: SC-8 | |
2218 | Identifica tion and A uthenticat ion | |
2219 | ||
2220 | I Will: | |
2221 | ||
2222 | Use passwo rds that m eet the VA minimum r equirement s. SOURCE: IA-5 (1) | |
2223 | Protect my passwords ; verify c odes, toke ns, and cr edentials from unaut horized us e and disc losure. SO URCE: IA-5 (h) | |
2224 | I Will Not : | |
2225 | ||
2226 | Store my p asswords o r verify c odes in an y file on any IT sys tem, unles s that fil e has been encrypted using FIP S 140-2 (o r its succ essor) val idated enc ryption, a nd I am th e only per son who ca n decrypt the file. SOURCE: IA -5 (1) (c) | |
2227 | Hardcode c redentials into scri pts or pro grams. SOU RCE: IA-5 (1) (c) | |
2228 | ||
2229 | Incident R eporting | |
2230 | ||
2231 | I Will: | |
2232 | ||
2233 | Report sus pected or identified informati on securit y incident s includin g anti-vir us, antisp yware, fir ewall or i ntrusion d etection s oftware er rors, or s ignificant alert mes sages (sec urity and privacy) t o my VA su pervisor o r designee immediate ly upon su spicion. S OURCE: IR- 6 | |
2234 | ||
2235 | ACKNOWLEDG EMENT AND ACCEPTANCE | |
2236 | ||
2237 | I acknowle dge that I have rece ived a cop y of VA in formation Security R ules of Be havior. | |
2238 | I understa nd, accept and agree to comply with all terms and conditions of VA Inf ormation S ecurity Ru les of Beh avior. | |
2239 | ||
2240 | ||
2241 | ||
2242 | ||
2243 | ||
2244 | ||
2245 | ||
2246 | ||
2247 | ||
2248 | Print or t ype your f ull nameSi gnatureDat e | |
2249 | ||
2250 | ||
2251 | ||
2252 | ||
2253 | ||
2254 | ||
2255 | ||
2256 | ||
2257 | Office Pho nePosition Title | |
2258 | ||
2259 | ||
2260 | APPENDIX B : Glossary | |
2261 | A | |
2262 | Active Dir ectory Rig hts Manage ment Servi ce (RMS) E ncryption— VA-approve d program that limit s who can see email and Micros oft-based documents. RMS is a form of in formation rights man agement us ed on Micr osoft Wind ows that u ses encryp tion to li mit access to items such as Wo rd, Excel, PowerPoin t, Outlook , InfoPath , and XPS documents, and the o perations authorized users can perform o n them. Th e technolo gy prevent s the prot ected cont ent from b eing decry pted excep t by speci fied peopl e or group s, in cert ain enviro nments, un der certai n conditio ns, and fo r certain periods of time. Spe cific oper ations lik e printing , copying, editing, forwarding , and dele ting can b e allowed or disallo wed by con tent autho rs for ind ividual pi eces of co ntent. Sou rce: Micro soft | |
2263 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2264 | Availabili ty—Ensurin g timely a nd reliabl e access t o and use of informa tion. Sour ce: VA Han dbook 6500 | |
2265 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2266 | B | |
2267 | Blog—An on line journ al. A blog (shortene d from "We b log") is an online journal t hat may be personal or topical , which th e author m akes regul ar entries that appe ar in reve rse chrono logical or der and ca n be read by the gen eral publi c. Source: Wordsmith Education al Diction ary and Th esaurus | |
2268 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2269 | Breach—The loss, the ft, or oth er unautho rized acce ss, other than those incidenta l to the s cope of em ployment, to data co ntaining S PI, in ele ctronic or printed f orm, that results in the poten tial compr omise of t he confide ntiality o r integrit y of the d ata. | |
2270 | SOURCE: 38 U.S.C. § 5727 May o r may not be a breac h under th e HIPAA Pr ivacy and Security R ules, whic h define “ breach” as the unaut horized ac quisition, access, u se, or dis closure of PHI in vi olation of the HIPAA Privacy R ule, which compromis es the sec urity or p rivacy of such infor mation, ex cept where an unauth orized per son to who m such inf ormation i s disclose d would no t reasonab ly have be en able to retain su ch informa tion. Unde r these Ru les, breac h of PHI e xcludes a. Any unint entional a cquisition , access, or use of PHI by an employee o r individu al acting under the authority of a cover ed entity or busines s associat e if such acquisitio n, access, or use wa s made in good faith and withi n the cour se and sco pe of the employment or other profession al relatio nship with the cover ed entity or busines s associat e and does not resul t in furth er use or disclosure ; b. Any i nadvertent disclosur e from an individual who | |
2271 | ||
2272 | is otherwi se authori zed to acc ess PHI at a facilit y operated by a cove red entity or busine ss associa te to anot her simila rly situat ed individ ual at sam e facility ; and c. A ny such in formation received a s a result of such d isclosure is not fur ther acqui red, acces sed, or us ed. Source : VA Handb ook 6500 | |
2273 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2274 | C | |
2275 | Citrix Acc ess Gatewa y (CAG)—Ci trix Acces s Gateway (CAG) is a virtual p rivate net work (VPN) that allo ws remote access to VA interna l resource s. Access to CAG req uires two- factor aut henticatio n through required u se of a PI V card rea der or Saf eNet Mobil ePASS toke n. Source: VA FSS Bu lletin No. 270, VA R emote Acce ss: Citrix Access Ga teway (CAG ): Two-Fac tor Authen tication I mplementat ion Schedu le | |
2276 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2277 | Cloud—A co mputing mo del that e nables ubi quitous, c onvenient, on-demand network a ccess to a shared po ol of conf igurable c omputing r esources ( e.g., netw orks, serv ers, stora ge, applic ations, an d services ) that can be rapidl y provisio ned and re leased wit h minimal management effort or service p rovider in teraction. The model has essen tial chara cteristics (on-deman d self-ser vice broad network a ccess, res ource pool ing, rapid elasticit y, and mea sured serv ice), thre e service models (so ftware as a service, platform as a servi ce, and in frastructu re as a se rvice), an d four dep loyment mo dels (priv ate cloud, community cloud, pu blic cloud , and hybr id cloud). Source: N IST Specia l Publicat ion 800-14 5, The NIS T Definiti on of Clou d Computin g | |
2278 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2279 | Confidenti ality—Pres erving aut horized re strictions on access and discl osure, inc luding mea ns for pro tecting pe rsonal pri vacy and p roprietary informati on. Source : VA Handb ook 6500 | |
2280 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2281 | Continuous Readiness in Inform ation Secu rity Progr am (CRISP) —A program launched by VA's Of fice of In formation and Techno logy desig ned to tra nsform how VA access es, protec ts, and tr ansfers in formation within and outside o f VA. The program st andardizes how VA mo nitors and controls onboarding , offboard ing, appro priate acc ess, and t raining co mpliance f or all VA system use rs. Source : VA Memor andum VAIQ #7227211, Continuou s Readines s in Infor mation Sec urity Prog ram (CRISP ) Sustainm ent Phase | |
2282 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an | |
2283 | ||
2284 | item in th e appendix , select A lt + <left arrow> on your keyb oard. | |
2285 | Contractor s—People w ho agree t o supply V A with goo ds or serv ices at a certain pr ice. Contr actors are all non-V A users ha ving acces s to VA in formation resources through a contract, agreement, or other legal arra ngement. C ontractors must meet the secur ity levels defined b y the cont ract, agre ement, or arrangemen t. Contrac tors must read and s ign the RO B and comp lete secur ity awaren ess and pr ivacy trai ning prior to receiv ing access to the in formation systems. S ource: VA Handbook 6 500 | |
2286 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2287 | D | |
2288 | Designated Records M anagement Official—A person de signated t o serve as the recor ds officer for an or ganization , with ove rsight res ponsibilit ies for th e manageme nt, retent ion, and d isposition of VA rec ords for h is or her respective organizat ion, to in clude Cent ral Office program o ffices and respectiv e field fa cilities t hat fall u nder his o r her purv iew. Note that the t itle of th is officia l may vary from one organizati on to the next. | |
2289 | Other titl es include , but are not limite d to, Reco rds Office r, Records Liaison O fficer, Re cords Mana gement Off icer, Reco rds Manage ment Techn ician, and Records a nd Informa tion Manag ement Spec ialist. Th is designa ted offici al works i n cooperat ion and co ordination with the VA Records Officer. Source: Ad apted from VA Handbo ok 6300.1 | |
2290 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2291 | Disclosure —The act o f making V A knowledg e or facts known. Di sclosure i s to revea l or share informati on. At VA, the Princ iple of Di sclosure r equires th at “VA per sonnel wil l zealousl y guard al l personal data to e nsure that all discl osures are made with written p ermission or in stri ct accorda nce with p rivacy law s.” Source : VA Direc tive 6502 | |
2292 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2293 | E | |
2294 | Employees— People who work for VA in retu rn for pay . Employee s are all individual s who are employed u nder Title 5 or Titl e 38, Unit ed States Code, as w ell as ind ividuals w hom the De partment c onsiders e mployees, such as vo lunteers, without co mpensation employees , and stud ents and o ther train ees. Sourc e: VA Hand book 6500 | |
2295 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2296 | Encryption —Hides tex t in secre t code. En cryption i s the cryp tographic transforma tion of da ta (called “:plainte xt”) into a form (ca lled “ciph ertext”) t hat concea ls the dat a's origin al meaning to preven t it from being know n or used. If the tr ansformati on is reve rsible, th e correspo nding reve rsal proce ss is call ed “decryp tion,” whi ch is a tr ansformati on that re stores enc rypted dat a to its o riginal st ate. Sourc e: W3C Glo ssary | |
2297 | ||
2298 | Dictionary | |
2299 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2300 | F | |
2301 | Facebook—A web-based social ne twork site . Facebook is a soci al utility that conn ects peopl e with fri ends and o thers who work, stud y, and liv e around t hem. Peopl e use Face book to ke ep up with friends, upload an unlimited number of photos, po st links a nd videos, and learn more abou t the peop le they me et. Source : Facebook | |
2302 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2303 | Federal In formation Processing Standard (FIPS) 201 —Federal I nformation Processin g Standard s (FIPS) 2 01 Persona l Identity Verificat ion (PIV) of Federal Employees and Contr actors was developed to establ ish standa rds for id entity cre dentials. This stand ard specif ies the ar chitecture and techn ical requi rements fo r a common identific ation stan dard for f ederal emp loyees and contracto rs. The ov erall goal is to ach ieve appro priate sec urity assu rance for multiple a pplication s by effic iently ver ifying the claimed i dentity of individua ls seeking physical access to federally controlled governmen t faciliti es and ele ctronic ac cess to go vernment i nformation systems. Source: NI ST | |
2304 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2305 | Federal In formation Security M anagement Act (FISMA )—A law th at require s VA to ha ve an info rmation se curity pro gram. Titl e III of t he E-Gover nment Act requires e ach federa l agency t o develop, document, and imple ment an ag ency-wide program to provide i nformation security for the in formation and inform ation syst ems that s upport the operation s and asse ts of the agency, in cluding th ose provid ed or mana ged by ano ther agenc y, contrac tor, or ot her source . Source: NIST SP 80 0-63 | |
2306 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2307 | Federal Re cords Act— A law that requires VA to main tain a sys tem of rec ords. The Federal Re cords Act requires f ederal age ncies to m ake and pr eserve rec ords that have adequ ate and pr oper docum entation o f their or ganization s, functio ns, polici es, decisi ons, proce dures, and essential transacti ons. These records a re federal property and must b e maintain ed and man aged accor ding to la ws and reg ulations. Source: ht tp://www2. ed.gov/pol icy/gen/le g/fra.html | |
2308 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2309 | File plan— A document containin g the iden tifying nu mber, titl e or descr iption, an d disposit ion author ity of fil es held in an office . The file plan shou ld contain up-to-dat e and accu rate dispo sition aut horities a nd retenti on periods for all r ecords and nonrecord | |
2310 | ||
2311 | materials maintained in the of fice. Sour ce: http:/ /www.archi ves.gov/ r ecords-mgm t/publicat ions/dispo sition-of- federal-re cords/ | |
2312 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2313 | Flickr—A w eb-based p hoto and v ideo host service. F lickr allo ws users t o store, s ort, searc h, and sha re photos and videos online th rough soci al network ing sites. Source: h ttp://www. flickr.com /help/gene ral/ | |
2314 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2315 | Freedom of Informati on Act (FO IA)—A law that gives people th e right to see feder al governm ent record s. FOIA pr ovides tha t any pers on has a r ight of ac cess to fe deral agen cy records , except t o the exte nt that su ch records are prote cted from release by a FOIA ex emption or a special law enfor cement rec ord exclus ion. It is VA's poli cy to rele ase inform ation to t he fullest extent un der the la w. Source: http:/ DNS . URL | |
2316 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2317 | G | |
2318 | General Re cords Sche dule (GRS) —General R ecords Sch edules (GR S) are iss ued by the Archivist of the Un ited State s to provi de disposi tion autho rization f or records common to several o r all agen cies of th e federal government . They inc lude recor ds relatin g to civil ian person nel, fisca l accounti ng, procur ement, com munication s, printin g, and oth er common functions and certai n nontextu al records . They als o include records re lating to temporary commission s, boards, councils, and commi ttees. The se records comprise an estimat ed one-thi rd of the total volu me of reco rds create d by feder al agencie s. Source: National Archives a nd Records Administr ation (NAR A) | |
2319 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2320 | Google+—A web-based social net work site that lets users with similar i nterests s hare links , videos, pictures, and other content. S ource: Goo gle+ | |
2321 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2322 | H | |
2323 | Health Inf ormation T echnology for Econom ic and Cli nical Heal th Act (HI TECH)—A la w that des cribes whe n and how VA hospita ls and doc tors can e xchange a person's h ealth info rmation. T he HITECH Act of the American Recovery a nd Reinves tment Act imposes mo re stringe nt regulat ory requir ements und er the sec urity and privacy ru les of Hea lth Insura nce Portab ility and Accountabi lity Act ( HIPAA), in creases ci vil penalt ies for a violation of HIPAA, provides f unding for hospitals and physi cians for the adopti on of heal th informa tion techn ology, and requires notificati on to pati ents of a security b reach. | |
2324 | ||
2325 | These broa d new requ irements w ill necess itate comp liance by covered en tities, bu siness ass ociates, a nd related vendors i n the heal th care in dustry. So urce: htt p://www.ni xonpeabody .com/11792 7 | |
2326 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2327 | Health Ins urance Por tability a nd Account ability Ac t (HIPAA) and HIPAA Privacy Ru le (1996)— A law that requires VA to keep a person' s health i nformation private. | |
2328 | HIPAA esta blishes re quirements for prote cting priv acy of per sonal heal th informa tion. Titl e I of HIP AA protect s health i nsurance c overage fo r workers and their families w hen they c hange or l ose their jobs. Titl e II of HI PAA, known as the Ad ministrati ve Simplif ication (A S) provisi ons, requi res the es tablishmen t of natio nal standa rds for el ectronic h ealth care transacti ons and na tional ide ntifiers f or provide rs, health insurance plans, an d employer s. The AS provisions also addr ess the se curity and privacy o f health d ata. The s tandards a re meant t o improve the effici ency and e ffectivene ss of the nation's h ealth care system by encouragi ng the wid espread us e of elect ronic data interchan ge in the U.S. healt h care sys tem. Sourc e: http:/ /www.hipaa .com/ | |
2329 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2330 | I | |
2331 | Identity T heft—A fra ud committ ed using t he identif ying infor mation of another pe rson. Sour ce: VA Han dbook 6500 | |
2332 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2333 | Incident—A n occurren ce that ac tually or potentiall y jeopardi zes the co nfidential ity, integ rity, or a vailabilit y of an in formation system or the inform ation the system pro cesses, st ores, or t ransmits o r that con stitutes a violation or immine nt threat of violati on of secu rity polic ies, secur ity proced ures, or a cceptable use polici es. Source : VA Handb ook 6500 | |
2334 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2335 | Informatio n Security —Keeping V A sensitiv e informat ion safe. Informatio n security is protec ting infor mation and informati on systems from unau thorized a ccess, use , disclosu re, disrup tion, modi fication, or destruc tion in or der to pro vide integ rity, conf identialit y, and ava ilability. Source: V A Handbook 6500 | |
2336 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2337 | ||
2338 | Instagram— A web-base d photo sh aring site . Users sh are images , graphics , photos, and short videos wit h friends. Source: I nstagram | |
2339 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2340 | Instant me ssage (IM) —Used to s end a real -time note to anothe r Internet user. Ins tant messa ge (IM) al lows users to see th e current availabili ty of othe rs and to start a re al- time, online con versation with them. Source: M icrosoft | |
2341 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2342 | Integrity— Guarding a gainst imp roper info rmation mo dification or destru ction and includes e nsuring in formation non-repudi ation and authentici ty. Source : VA Handb ook 6500 | |
2343 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2344 | J—N/A K—N/ A L | |
2345 | Local area network ( LAN)—A dat a communic ation syst em allowin g a number of indepe ndent devi ces to com municate d irectly wi th each ot her, withi n a modera tely sized geographi c area ove r a physic al communi cations ch annel of m oderate ra tes. Sourc e: VA Hand book 6500 | |
2346 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2347 | M | |
2348 | Malware—So ftware des igned to h arm a comp uter or sy stem. Malw are is a p rogram tha t is inser ted into a system, u sually cov ertly, wit h the inte nt of comp romising t he confide ntiality, integrity, or availa bility of the victim 's data, a pplication s, or oper ating syst em or of o therwise a nnoying or disruptin g the vict im. Source : NIST SP 800-83 | |
2349 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2350 | Microsoft Lync—Softw are used t o instantl y communic ate with c olleagues. Microsoft Lync is a n enterpri se-ready u nified com munication s platform . Lync pro vides a co nsistent, single cli ent experi ence for p resence, i nstant mes saging, vo ice, and v ideo. Sour ce: Micros oft | |
2351 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an | |
2352 | ||
2353 | item in th e appendix , select A lt + <left arrow> on your keyb oard. | |
2354 | Microsoft Outlook Ca lendar—Sof tware used to chart daily, wee kly, month ly, or yea rly events . Microsof t Outlook Calendar i s the cale ndar and s cheduling component of Outlook and is fu lly integr ated with email, con tacts, and other fea tures. Sou rce: Micro soft | |
2355 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2356 | Microsoft SharePoint —Software used to st ore docume nts on an Intranet s ite. It ca n be used to set up collaborat ive sites to share i nformation with othe rs, manage documents from star t to finis h, and pub lish repor ts to help make deci sions. Sou rce: Micro soft | |
2357 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2358 | N | |
2359 | Non-organi zational u sers—Are i dentified as all inf ormation s ystem user s other th an VA user s explicit ly categor ized as or ganization al users. Source: VA IQ 7714283 , Modified VA Inform ation Secu rity Rules of Behavi or, August 24, 2016 | |
2360 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2361 | Notice She et—A sheet of paper for intern al mail th at is a co ver sheet that accom panies doc uments sen t through interoffic e mail tha t contain VA sensiti ve informa tion. Howe ver sent, every indi vidual art icle or gr ouping of mail that contains V A sensitiv e informat ion and is sent from VA to any VA person nel must b e accompan ied by a n otice shee t containi ng languag e that exp lains ther e are pena lties for violations of the Pr ivacy Act and the He alth Insur ance Porta bility and Accountab ility Act Privacy Ru le. These notice she ets must b e inserted as cover sheets to the docume nt. Source : VA Direc tive 6609 | |
2362 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2363 | O | |
2364 | Organizati onal users —Are ident ified as V A employee s, contrac tors, rese archer, st udents, vo lunteers, and repres entatives of federal , state, l ocal, or t ribal agen cies. Sour ce: VAIQ 7 714283, Mo dified VA Informatio n Security Rules of Behavior, August 24, 2016 | |
2365 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2366 | P | |
2367 | ||
2368 | Paper logb ooks—A wri tten, non- electronic record in tended to track info rmation fo r someone' s personal use. Pape r logbooks for perso nal use in clude any record of activity o r events c omprising data that may unique ly identif y an indiv idual or c ontain sen sitive per sonal info rmation an d are main tained ove r a period of time f or the pur pose of tr acking inf ormation o r creating a histori cal record for one's own use. Source: VA Memorandu m VAIQ #70 92263, Pro hibition o f Written Logbooks | |
2369 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2370 | Password—A word or g roup of ch aracters t hat is use d to gain entry to a n electron ic system. A protect ed/private string of letters, numbers, a nd/or spec ial charac ters used to authent icate an i dentity or to author ize access to data. Source: NI ST IR 7298 , Glossary of Key In formation Security T erms | |
2371 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2372 | Personal I dentity Ve rification (PIV) car ds—An ID c ard that r eceives, s tores, rec alls, and sends data securely. The PIV c ard is an ID card is sued by a federal ag ency that contains a computer chip, whic h allows i t to recei ve, store, recall, a nd send in formation in a secur e method. The main f unction of the card is to encr ypt or cod e data to strengthen the secur ity of bot h employee s' and Vet erans' inf ormation a nd physica l access t o secured areas, whi le using a common te chnical an d administ rative pro cess. The method use d to achie ve this is called Pu blic Key I nfrastruct ure (PKI) technology . | |
2373 | PKI compli es with al l federal and VA sec urity poli cies and i s the acce pted Globa l Business Standard for Intern et Securit y. As an a dded benef it, PKI ca n provide the functi onality fo r digital signatures to ensure document authentici ty. Source : http:// DNS . UR /pivprojec t/ | |
2374 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2375 | Personally Identifia ble Inform ation (PII )—PII is a ny informa tion that can be use d to disti nguish or trace an i ndividual' s identity , such as his or her name, Soc ial Securi ty number, biometric records, etc., alon e or when combined w ith other personal o r identify ing inform ation that is linked or linkab le to a sp ecific ind ividual, s uch as dat e and plac e of birth , mother's maiden na me, etc. I nformation does not have to be retrieved by any sp ecific ind ividual or unique id entifier ( i.e., cove red by the Privacy A ct) to be Personally Identifia ble Inform ation. Sou rce: Offic e of Manag ement and Budget (OM B) Memoran dum 07-16, Safeguard ing Agains t and Resp onding to Breaches o f Personal ly Identif iable Info rmation (M ay 22, 200 7) Note: T he term Pe rsonally I dentifiabl e Informat ion is syn onymous an d intercha ngeable wi th Sensiti ve Persona l Informat ion. | |
2376 | ||
2377 | Phishing—E fforts to steal pers onal data. Phishing is trickin g individu als into d isclosing sensitive personal i nformation through d eceptive c omputer-ba sed means. Source: N IST SP 800 -83 | |
2378 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2379 | Privacy—Ke eping data away from the view of other p eople. Pri vacy is fr eedom from unauthori zed intrus ion on Per sonally Id entifiable Informati on (PII) a nd an indi vidual's i nterest in limiting who has ac cess to pe rsonal hea lth care i nformation . Source: Partners H ealthcare Glossary o f Common T erms, Heal th Insuran ce Portabi lity and A ccountabil ity Act of 1996 (HIP AA) | |
2380 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2381 | Privacy Ac t of 1974— Legislatio n that sta tes how fe deral agen cies can u se persona l data. Th e Privacy Act of 197 4 establis hes a Code of Fair I nformation Practice that gover ns the col lection, m aintenance , use, and dissemina tion of Pe rsonally I dentifiabl e Informat ion about individual s that is maintained in system s of recor ds by fede ral agenci es. A syst em of reco rds is a g roup of re cords unde r the cont rol of an agency fro m which in formation is retriev ed by the name of th e individu al or by s ome identi fier assig ned to the individua l. The Pri vacy Act r equires th at agencie s give the public no tice of th eir system s of recor ds by publ ication in the Feder al Registe r. The Pri vacy Act p rohibits t he disclos ure of inf ormation f rom a syst em of reco rds withou t the writ ten consen t of the s ubject ind ividual, u nless the disclosure is pursua nt to one of twelve statutory exceptions . The act also provi des indivi duals with a means b y which to seek acce ss to and amendment of their r ecords and sets fort h various agency rec ord- keepi ng require ments. Sou rce: http: //www.just ice.gov/op cl/privacy act1974.ht m | |
2382 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2383 | Privacy Im pact Asses sment (PIA )—A PIA is an analys is that se eks to ide ntify and mitigate t he privacy and secur ity risks associated with the use of PII by a prog ram, syste m, or prac tice. A PI A provides a framewo rk for exa mining whe ther priva cy, securi ty, and ot her vital data issue s have bee n identifi ed, addres sed, and i ncorporate d into the plan, des ign, opera tion, main tenance, a nd disposa l of elect ronic info rmation sy stems. PIA s are requ ired to be performed in the co nceptualiz ation phas e of the s ystem life cycle and updated w henever a system cha nge could create a n ew privacy risk. Sou rce: VA Di rective 65 08 | |
2384 | ||
2385 | Privacy Sc reen—A scr een that c an be fast ened to a computer m onitor to keep data out of vie w. A priva cy screen is a panel that limi ts a compu ter screen 's angle o f vision t o a front view so th at visitor s in the r oom cannot casually see the di splay. Als o called a “privacy filter,” i t is attac hed direct ly over th e screen, which help s prevent scratches and abrasi ons. Sourc e: PCMag.c om Encyclo pedia | |
2386 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2387 | Privacy Th reshold An alysis (PT A)—A PTA i s used to identify I T systems, rulemakin gs for pri vacy risks , programs , or proje cts that i nvolve PII , and othe r activiti es that ot herwise im pact the p rivacy of individual s as deter mined by t he Directo r or VA Pr ivacy Serv ice and to assess wh ether ther e is a nee d for a Pr ivacy Impa ct Assessm ent (PIA). A PTA inc ludes a ge neral desc ription of the IT sy stem, tech nology, ru lemaking, program, p roject, or other Dep artment ac tivity and describes what PII is collect ed (and fr om whom) a nd how tha t informat ion is use d. Source: VA Handbo ok 6508, I mplementat ion of Pri vacy Thres hold Analy sis and Pr ivacy Impa ct Assessm ent | |
2388 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2389 | Prohibited activitie s—Using VA -issued de vices for inappropri ate action s. Prohibi ted activi ties inclu de, but ar e not limi ted to, us es that ca uses conge stion, del ay, or dis ruption to any syste m or equip ment; use of systems to gain u nauthorize d access t o other sy stems; the creation, copying, transmissi on, or ret ransmissio n of chain letters o r other un authorized mass mail ings; use for activi ties that are illega l, inappro priate, or offensive to fellow employees or the pu blic; the creation, downloadin g, viewing , storage, copying, or transmi ssion of s exually ex plicit or sexually o riented ma terials; t he creatio n, downloa ding, view ing, stora ge, copyin g, or tran smission o f material s related to gamblin g, illegal weapons, terrorist activities , or other illegal o r prohibit ed activit ies; use f or commerc ial purpos es or “for profit” a ctivities or in supp ort of out side emplo yment or b usiness ac tivities, such as co nsulting f or pay, sa le or admi nistration of busine ss transac tions, or sale of go ods or ser vices; eng aging in o utside fun draising a ctivity, e ndorsing a ny product or servic e, or enga ging in an y prohibit ed partisa n activity ; particip ating in l obbying ac tivity wit hout autho rity; use for postin g agency i nformation to extern al news gr oups, bull etin board s, or othe r public f orums with out author ity; use t hat could generate m ore than m inimal exp ense to th e governme nt; and th e unauthor ized acqui sition, us e, reprodu ction, tra nsmission, or distri bution of privacy in formation, copyright ed, or tra demarked p roperty be yond fair use, propr ietary dat a, or expo rt- contro lled softw are or dat a. Source: VA Direct ive 6001 | |
2390 | ||
2391 | Protected Health Inf ormation ( PHI)—The H IPAA Priva cy Rule de fines PHI as individ ually iden tifiable h ealth Info rmation tr ansmitted or maintai ned in any form or m edium by a covered e ntity, suc h as VHA. Note: VHA uses the t erm Protec ted Health Informati on to defi ne informa tion that is covered by HIPAA, but unlik e individu ally ident ifiable he alth infor mation, ma y or may n ot be cove red by the Privacy A ct or Titl e 38 confi dentiality statutes. In additi on, PHI ex cludes emp loyment re cords held by VHA in its role as an empl oyer. Sour ce: 45 C.F .R. § 160. 103; VA Di rective 60 66 | |
2392 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2393 | Public Key Infrastru cture (PKI ) encrypti on—VA-appr oved softw are that i s used to hide text in secret code and s ecure the delivery o f electron ic service s to VA em ployees, c ontractors , and busi ness partn ers. PKI e ncryption is part of an overal l security strategy that combi nes hardwa re, softwa re, polici es, and ad ministrati ve procedu res to cre ate a fram ework for transferri ng data in a secure and confid ential man ner. PKI e ncryption is a criti cal compon ent to saf eguard net worked inf ormation s ystems and assets an d to condu ct busines s securely over publ ic and pri vate telec ommunicati on network s. Source: VA Handbo ok 6500 | |
2394 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2395 | R | |
2396 | Records—Fo rmal writt en facts a bout a per son or VA. Records a re defined different ly in the Privacy Ac t and the Federal Re cords Act. Both defi nitions mu st be cons idered in handling V A records. (1) Recor ds include all books , papers, maps, phot ographs, m achine rea dable mate rials, or other docu mentary ma terials, r egardless of physica l form or characteri stics, mad e or recei ved by an agency of the United States Go vernment u nder feder al law or in connect ion with t he transac tion of pu blic busin ess and pr eserved or appropria te for pre servation by that ag ency or it s legitima te success or as evid ence of th e organiza tion, func tions, pol icies, dec isions, pr ocedures, operations , or other activitie s of the g overnment or because of the in formationa l value of data in t hem. Sourc e: Federal Records A ct (44 U.S .C. 3301). (2) Recor d means an y item, co llection, or groupin g of infor mation abo ut an indi vidual tha t is maint ained by a n agency, including, but not l imited to, his or he r educatio n, financi al transac tions, med ical histo ry, and cr iminal or employment history, which cont ains his o r her name , or the i dentifying number, s ymbol, or other iden tifying pa rticular a ssigned to the indiv idual, suc h as a fin ger or voi ce print o r a photog raph. Sour ce: VA Han dbook 6300 .1 and VA Handbook 6 300.5 | |
2397 | ||
2398 | Records Co ntrol Sche dule (RCS) —A documen t that con tains the retention and dispos ition ruli ngs as app roved by N ARA that d escribes h ow long sc heduled VA records m ust be mai ntained be fore being disposed of. A Reco rds Contro l Schedule is requir ed by stat ute. All V A records and inform ation must be identi fied by re cords seri es and be listed in the aforem entioned R ecords Con trol Sched ule. Sourc e: Adapted from VA H andbook 63 00.1 | |
2399 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2400 | Records in ventory—A descriptiv e listing of each re cord serie s or syste m, togethe r with an indication of locati on and oth er pertine nt data. I t is not a list of e ach docume nt or each folder bu t rather o f each ser ies or sys tem. Its m ain purpos e is to pr ovide the informatio n needed t o develop the schedu le. It als o helps id entify var ious recor ds managem ent proble ms. These include in adequate d ocumentati on of offi cial actio ns, improp er applica tions of r ecordkeepi ng technol ogy, defic ient filin g systems and mainte nance prac tices, poo r manageme nt of nonr ecord mate rials, ins ufficient identifica tion of vi tal record s, and ina dequate re cords secu rity pract ices. When completed , the inve ntory shou ld include all offic es, all re cords, and all nonre cord mater ials. An i nventory t hat is inc omplete or haphazard can only result in an inadequ ate schedu le and los s of contr ol over re cords. Sou rce: http: //www.arch ives.gov/r ecords- m gmt/public ations/dis position-o f-federal- records/ | |
2401 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2402 | Regulatory or progra m-specific informati on—Informa tion that VA may not release o r may rele ase only i n very lim ited, spec ified situ ations. Th is categor y of infor mation, wh ich normal ly would n ot be rele ased to th e public ( 5 U.S.C. S ection 552 —the Freed om of Info rmation Ac t), may in clude cert ain critic al informa tion about VA's prog rams, fina ncial info rmation, l aw enforce ment or in vestigativ e informat ion, procu rement inf ormation, and busine ss proprie tary infor mation. So urce: VA P rivacy Ser vice | |
2403 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2404 | Remote acc ess—Access to a comp uter or ne twork that is far aw ay. Remote access is access to an organi zational i nformation system by a user (o r an infor mation sys tem acting on behalf of a user ) communic ating thro ugh an ext ernal netw ork (e.g., the Inter net). Sour ce: NIST S P 800-53 | |
2405 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an | |
2406 | ||
2407 | Remote Ent erprise Se curity Com pliance Up date Envir onment (RE SCUE)—A pr ogram used by VA to provide em ployees wi th remote access usi ng governm ent- furni shed equip ment (GFE) . Source: https:// DNS . URL /FAQ | |
2408 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2409 | Rules of B ehavior (R OB)—A set of Departm ent rules that descr ibes the r esponsibil ities and expected b ehavior of users of VA informa tion syste ms or VA i nformation . Source: VA Handboo k 6500 | |
2410 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2411 | S | |
2412 | SafeNet Mo bilePASS—S afeNet Mob ilePASS so ft token i s the alte rnative fo r non-PIV enabled de vices (e.g ., no USB port or ca rd reader) to satisf y two-fact or authent ication re quirements for acces s. The app lication i nstalls a token on t he device and makes the device the somet hing you h ave in two -factor au thenticati on. Source : Modified from VA F SS Bulleti n No. 270, VA Remote Access: C itrix Acce ss Gateway (CAG): Tw o-Factor A uthenticat ion Implem entation S chedule | |
2413 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2414 | Sensitive Personal I nformation (SPI)—The term, wit h respect to an indi vidual, me ans any in formation about the individual maintaine d by VA, i ncluding t he followi ng: (i) ed ucation, f inancial t ransaction s, medical history, and crimin al or empl oyment his tory; | |
2415 | (ii) infor mation tha t can be u sed to dis tinguish o r trace th e individu al’s ident ity, inclu ding name, Social Se curity num ber, date and place of birth, mother’s m aiden name , or biome tric recor ds. NOTE: The term “ Sensitive Personal I nformation ” is synon ymous and interchang eable with “Personal ly Identif iable Info rmation.” Source: 3 8 U.S.C. § 5727 | |
2416 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2417 | Social eng ineering—A n attempt to trick s omeone int o revealin g informat ion (e.g., a passwor d) that ca n be used to attack systems or networks. Source: N IST SP 800 -82 | |
2418 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2419 | Social med ia—Web and mobile-ba sed tools that allow persons a nd groups to exchang e ideas. S ocial medi a is speci fically de signed for social in teraction that uses highly acc essible an d scalable publishin g techniqu es using w eb-based t echnologie s. | |
2420 | ||
2421 | Social med ia uses we b-based co llaboratio n technolo gies to bl end techno logy and s ocial inte raction in order to transform and broadc ast media monologues into soci al dialogu e, thereby transform ing people from cont ent consum ers to con tent produ cers. This form of m edia does not includ e email. S ource: VA Directive 6515 | |
2422 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2423 | Spoofing—S poofing re fers to se nding a ne twork pack et that ap pears to c ome from a source ot her than i ts actual source. So urce: NIST SP 800-48 | |
2424 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2425 | T | |
2426 | Text messa ging—The s ending of short text messages electronic ally, espe cially fro m one cell phone to another. S ource: www .merriam-w ebster.com | |
2427 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2428 | Tweets—Bri ef message s sent thr ough Twitt er. Tweets are small bursts of informati on that ar e no more than 140 c haracters long. Addi tionally, users can include an d see phot os, videos , and conv ersations directly i n Tweets t o get the whole stor y at a gla nce and al l in one p lace. Sour ce: Twitte r | |
2429 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2430 | Twitter—Al lows peopl e to stay connected through th e exchange of short messages. Twitter is a real-ti me informa tion netwo rk that co nnects use rs to the latest sto ries, idea s, opinion s, and new s about wh at they fi nd interes ting. User s can find the accou nts they f ind most c ompelling and follow the conve rsations. Source: Tw itter | |
2431 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2432 | Two-factor authentic ation—The process of establish ing confid ence in th e identity of users or informa tion syste ms through two facto rs. The tw o factors are someth ing the us er knows a nd somethi ng the use r has. Sou rce: Modif ied from N IST Specia l Publicat ion 800-63 -2, Electr onic Authe ntication Guideline | |
2433 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2434 | U—N/A | |
2435 | ||
2436 | V | |
2437 | VA Confide ntiality S tatutes—(T itle 38 U. S.C. 5701, 5705, 733 2) Statute s requirin g VA to ke ep medical claims, i nformation , and heal th records private. (1) Title 38 U.S.C. | |
2438 | 5701: VA C laims Conf identialit y Statute is a statu te that st ates VA mu st keep cl aims priva te. VA Con fidentiali ty Statute 38 U.S.C. 5701 prov ides for t he confide ntiality o f all VHA patient cl aimant and dependent informati on with sp ecial prot ection for names and home addr esses. (2) Title 38 U.S.C. 570 5: Confide ntiality o f Medical Quality As surance Re cords is a statute t hat states VA should n't disclo se medical quality-a ssurance p rogram inf ormation w ithout per mission. V A Confiden tiality St atute 38 U .S.C. 5705 provides for the co nfidential ity of Hea lthcare Qu ality Assu rance (QA) records. Records cr eated by V HA as part of a desi gnated med ical quali ty assuran ce program are confi dential an d privileg ed. VHA ma y only dis close this data in a few, limi ted situat ions. | |
2439 | (3) Title 38 U.S.C. § 7332: Co nfidential ity of Cer tain Medic al Records is a stat ute that s tates VA m ust keep h ealth reco rds contai ning drug abuse, alc ohol abuse , HIV, and Sickle Ce ll Anemia private. V A Confiden tiality St atute 38 U .S.C. § 73 32 provide s for the confidenti ality of V A created, individua lly identi fiable dru g abuse, a lcoholism or alcohol abuse, in fection wi th the hum an immunod eficiency virus (HIV ), or Sick le Cell An emia. This statute p rohibits u se or disc losure wit h only a f ew excepti ons. VHA m ay use the informati on to trea t the VHA patient wh o is the r ecord subj ect. VHA m ust have s pecific wr itten auth orization in order t o disclose this info rmation, i ncluding f or treatme nt by a no n-VA provi der. Sourc e:
|
|
2440 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2441 | VA Pulse—A web-based social ne tworking s ite for VA employees . VA Pulse is a coll aborative platform f or staff t o share be st practic es, connec t with col leagues to solve pro blems, and discover ideas to h elp improv e the Vete ran experi ence. Sour ce: VA Pul se | |
2442 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2443 | VA sensiti ve informa tion—VA se nsitive in formation/ data is al l Departme nt informa tion and/o r data, on any stora ge media o r in any f orm or for mat, which requires protection due to th e risk of harm that could resu lt from in advertent or deliber ate disclo sure, alte ration, or destructi on of the informatio n. The ter m includes not only informatio n that ide ntifies an individua l but also other inf ormation w hose impro per use or disclosur e could ad versely af fect the a bility of an agency to accompl ish its mi ssion, pro prietary i nformation , and reco rds about individual s requirin g protecti on under v arious con fidentiali ty provisi ons. Sourc e: 38 U.S. C. Section 5727 | |
2444 | ||
2445 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2446 | VAntage Po int—The of ficial blo g of VA. V A employee s provide informatio n to Veter ans in pos ts and art icles feat ured on VA ntage Poin t. Others can also c ontribute and submit content f or publica tion. Sour ce: http:/ / DNS . URL /VAntage/a bout/ | |
2447 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2448 | Virtual lo cal area n etwork (VL AN)—A netw ork of phy sical netw orks divid ed into sm aller logi cal networ ks to incr ease perfo rmance, im prove mana geability, and simpl ify networ k design. VLANs are achieved t hrough con figuration of Ethern et switche s. | |
2449 | Source: NI ST Special Publicati on 800-82, Revision 2, Guide t o Industri al Control Systems ( ICS) Secur ity | |
2450 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2451 | Virtual Pr ivate Netw ork (VPN)— A virtual private ne twork (VPN ) is a pri vate data network th at makes u se of the public tel ecommunica tion infra structure, maintaini ng privacy through t he use of a tunnelin g protocol and secur ity proced ures. Sour ce: Virtua l Private Network Co nsortium | |
2452 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2453 | W | |
2454 | Wi-Fi—A sy stem of ac cessing th e Internet from remo te machine s such as laptop com puters tha t have wir eless conn ections. S ource: www .dictionar y.com | |
2455 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2456 | Wireless N etwork—A n etwork of computers that are n ot connect ed by cabl es. Wirele ss network s utilize radio wave s and/or m icrowaves to maintai n communic ation chan nels betwe en compute rs. Wirele ss network ing is a m ore modern alternati ve to wire d networki ng that re lies on co pper and/o r fiber op tic cablin g between network de vices. | |
2457 | Source: ht tp://compn etworking. about.com/ cs/wireles s/f/whatis wireless.h tm | |
2458 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2459 | X—N/A Y—N/ A | |
2460 | YouTube—Th e name of a website on which u sers can p ost, view, or share videos. | |
2461 | ||
2462 | Source: Yo uTube. (n. d.). Dicti onary.com Unabridged . Retrieve d May 26, 2015, from Dictionar y.com | |
2463 | To return to your pl ace in the main docu ment after selecting a hyperli nk to an i tem in the appendix, select Al t + <left arrow> on your keybo ard. | |
2464 | Z—N/A | |
2465 | ||
2466 | ||
2467 | APPENDIX C : Privacy and Inform ation Secu rity Resou rces | |
2468 | Table 1. V A Phone Nu mbers Tab le 2. VA W eb Links Table 3. V A TMS Cour ses | |
2469 | Table 4. P rivacy Law s and Regu lations | |
2470 | Table 5. I nformation Security Laws, Regu lations, a nd Related Statutes/ Specifica tions Tab le 6. Sele cted VA Pr ivacy Hand books and Directives | |
2471 | Table 7. A dditional Selected V A Handbook s and Dire ctives Ta ble 8. For ms and Mem orandums | |
2472 | ||
2473 | ||
2474 | Table 1. V A Phone Nu mbers | |
2475 | Identity T heft Help Line (to r eport an i dentity th eft incide nt involvi ng a Veter an) (855) 578-5492 | |
2476 | Office of Inspector General (I G) Hotline (to repor t fraud, w aste, or m ismanageme nt of reso urces) | |
2477 | (800) 488- 8244 | |
2478 | VA Nationa l Service Desk (to r equest com puter, net work, or a ccess supp ort; or to report se curity inc idents to the Networ k Security Operation s Center [ NSOC]) | |
2479 | (855) 673- 4357. | |
2480 | Select opt ion 6 for Computer, Network, o r Access S upport. Se lect optio n 4 for NS OC. | |
2481 | ||
2482 | ||
2483 | Table 2. V A Web Link s | |
2484 | *These lin ks are onl y accessib le on the VA Intrane t | |
2485 | CRISP info rmation* | |
2486 | https:// DNS . URL /oitauditp rep/SitePa ges/Home.a spx | |
2487 | ||
2488 | ||
2489 | Table 2. V A Web Link s | |
2490 | FSS HISD S harePoint site for M DPP guidan ce* | |
2491 | https:// DNS . URL /sites/inf osecurity/ fieldsecur ity/HISD.a spx | |
2492 | Informatio n Security Portal* | |
2493 | https:// DNS . URL /sites/inf osecurity/ index.aspx | |
2494 | ITWD’s rol e-based tr aining* | |
2495 | http:// DNS . URL /sites/itt rainingaca demy/rbt/P ages/defau lt.aspx | |
2496 | Locator to identify ISOs*and P Os https:// DNS . URL /sites/inf osecurity/ ISO-PO- Lo cator/defa ult.aspx | |
2497 | PIV cards | |
2498 | ht DNS . URL /PIVPROJEC T/index.as p | |
2499 | Remote acc ess soluti ons* https:// DNS . URL /Default.a spx?strSou rce=u+ICXX nt3TlrIVos SsqAAB gr Af O5euqrc alEYQjZ0d7 TQ+n8hKoNY UEUKNucaA2 wE7Cdxa4vj 6MmCL1waoA FIw | |
2500 | Rights Man agement Se rvice (RMS )* | |
2501 | http:// DNS . URL /RMS/Lists /External% 20RMS%20En abling%20R e quest/Al lItems.asp x | |
2502 | Role Defin itions PDF document* http:// DNS . URL /sites/itt rainingaca demy/rbt/S hared%20Do cument s/ Role%20Def initions.p df | |
2503 | ||
2504 | ||
2505 | Table 3. V A TMS Cour ses | |
2506 | Available at: https: // DNS . URL/si t e s /inf o security / index.aspx | |
2507 | TMS ID 102 03, Privac y and HIPA A Training | |
2508 | TMS ID 336 914, An In troduction to Rights Managemen t Service— RMS | |
2509 | ||
2510 | ||
2511 | Table 3. V A TMS Cour ses | |
2512 | TMS ID 125 6927, Gett ing Starte d with Pub lic Key In frastructu re | |
2513 | TMS ID 262 6967, Soci al Network ing and Se curity Awa reness | |
2514 | TMS ID 385 8544, Soci al Enginee ring—Hacki ng Human N ature | |
2515 | TMS ID 392 6743, Mobi le Trainin g: Apple N ative Emai l Client | |
2516 | TMS ID 392 6744, Mobi le Trainin g: Securit y of Apps on iOS Dev ices | |
2517 | ||
2518 | ||
2519 | Table 4. P rivacy Law s and Regu lations | |
2520 | Available at: http:/ / DNS . URL /privacy_r esources.a sp | |
2521 | Freedom of Informati on Act (FO IA) | |
2522 | Requires f ederal age ncies to d isclose re cords requ ested in w riting by any person , subject to certain exemption s and excl usions. | |
2523 | Health Inf ormation T echnology for Econom ic and Cli nical Heal th Act (HI TECH) Desc ribes when and how h ospitals, doctors, a nd certain others ma y safely e xchange in dividuals’ health in formation. It also l imits the use of per sonal medi cal inform ation for marketing purposes a nd increas es fines f or unautho rized disc losures of health in formation. | |
2524 | Health Ins urance Por tability a nd Account ability Ac t (HIPAA) | |
2525 | Establishe s requirem ents for p rotecting privacy of personal health inf ormation. | |
2526 | Paperwork Reduction Act | |
2527 | Establishe s the gove rnance fra mework and the gener al princip les, conce pts, and p olicies th at guide t he federal governmen t in manag ing inform ation and its relate d resource s, includi ng records . | |
2528 | Privacy Ac t | |
2529 | Requires f ederal age ncies to e stablish a ppropriate safeguard s to ensur e the secu rity and c onfidentia lity of th e records they maint ain about individual s, establi shes restr ictions on the discl osure and use of tho se records by federa l agencies , and perm its indivi duals to a ccess and request am endments t o records | |
2530 | ||
2531 | ||
2532 | Table 4. P rivacy Law s and Regu lations | |
2533 | about them selves. | |
2534 | Freedom of Informati on Act (FO IA) | |
2535 | Requires f ederal age ncies to d isclose re cords requ ested in w riting by any person , subject to certain exemption s and excl usions. | |
2536 | Health Inf ormation T echnology for Econom ic and Cli nical Heal th Act (HI TECH) Desc ribes when and how h ospitals, doctors, a nd certain others ma y safely e xchange in dividuals’ health in formation. It also l imits the use of per sonal medi cal inform ation for marketing purposes a nd increas es fines f or unautho rized disc losures of health in formation. | |
2537 | ||
2538 | ||
2539 | Table 5. I nformation Security Laws, Regu lations, a nd Related Statutes/ Specificat ions | |
2540 | Federal In formation Security M odernizati on Act(FIS MA) | |
2541 | http://www .dhs.gov/f iles/progr ams/gc_128 1971047761 .shtm | |
2542 | Requires f ederal age ncies to h ave a prog ram to ass ess risk a nd protect informati on and inf ormation s ecurity as sets that support ag ency opera tions. | |
2543 | Federal Re cords Act of 1950 | |
2544 | http://www 2.ed.gov/p olicy/gen/ leg/fra.ht ml | |
2545 | Describes federal ag ency respo nsibilitie s for maki ng and pre serving re cords and for establ ishing and maintaini ng active, continuin g programs for the e conomic an d efficien t manageme nt of the records ag ency. (Rel ated regul ations: 44 U.S.C. Ch apters 21, 29,31,33 a nd 35 (Fed eral Recor ds Act); 3 6 CFR Chap ter XII, S ubchapter B - Record s Manageme nt Part 12 20-1238;an d OMB Circ ular A-130 Managemen t of Feder al Informa tion) | |
2546 | Internal R evenue Cod e (IRC) Sp ecificatio ns IRC at 26 U.S.C.A . § 6103 ( p)(4). | |
2547 | http://www .patentoff icelawsuit .info/irs_ 6103.htm | |
2548 | Requires s pecific se curity pro tection fo r income t ax return informatio n (as | |
2549 | ||
2550 | ||
2551 | Table 5. I nformation Security Laws, Regu lations, a nd Related Statutes/ Specificat ions | |
2552 | defined in § 6103 [b] [2]) that is provid ed to VA e lectronica lly under income ver ification matching ( IVM) agree ments with the Inter nal Revenu e Service and the So cial Secur ity Admini stration. Tax inform ation subm itted to V A by the t axpayer is protected by the Pr ivacy Act, but does not requir e the spec ialized ca re specifi ed by §610 3. | |
2553 | Federal In formation Security M odernizati on Act (FI SMA) | |
2554 | http://www .dhs.gov/f iles/progr ams/gc_128 1971047761 .shtm | |
2555 | Requires f ederal age ncies to h ave a prog ram to ass ess risk a nd protect informati on and inf ormation s ecurity as sets that support ag ency opera tions. | |
2556 | FIPS 140-2 | |
2557 | Security R equirement s for Cryp tographic Modules | |
2558 | Federal Re cords Act of 1950 | |
2559 | http://www 2.ed.gov/p olicy/gen/ leg/fra.ht ml | |
2560 | Describes federal ag ency respo nsibilitie s for maki ng and pre serving re cords and for establ ishing and maintaini ng active, continuin g programs for the e conomic an d efficien t manageme nt of the records ag ency. (Rel ated regul ations: 44 U.S.C. Ch apters 21, 29,31,33 a nd 35 (Fed eral Recor ds Act); 3 6 CFR Chap ter XII, S ubchapter B - Record s Manageme nt Part 12 20-1238;an d OMB Circ ular A-130 Managemen t of Feder al Informa tion) | |
2561 | ||
2562 | ||
2563 | Table 6. S elected VA Privacy H andbooks a nd Directi ves | |
2564 | Available at: http:/ / DNS . URL /vapubs/in dex.cfm | |
2565 | VA Directi ve 6066, P rotected H ealth Info rmation(PH I) | |
2566 | VA Directi ve 6300, R ecords and Informati on Managem ent | |
2567 | VA Directi ve 6371, D estruction of Tempor ary Paper Records | |
2568 | VA Handboo k 6300.4, Procedures for Proce ssing Requ ests for R ecords Sub ject | |
2569 | ||
2570 | ||
2571 | Table 6. S elected VA Privacy H andbooks a nd Directi ves | |
2572 | to the Pri vacy Act | |
2573 | VA Handboo k 6300.5, Procedures for Estab lishing an d Managing Privacy A ct System of Records | |
2574 | VA Handboo k 6500, Ri sk Managem ent Framew ork for VA Informati on Systems | |
2575 | – Tier 3: VA Informa tion Secur ity Progra m and Appe ndix D, VA National Rules of B ehavior | |
2576 | VA Handboo k 6500.1, Electronic Media San itization | |
2577 | VA Handboo k 6500.2, Management of Data B reaches In volving Se nsitive Pe rsonal Inf ormation | |
2578 | VA Handboo k 6502, VA Enterpris e Privacy Program | |
2579 | VA Handboo k 6502.4, Privacy Ac t Review | |
2580 | VA Handboo k 6512, Se cure Wirel ess Techno logy | |
2581 | VA Handboo k 6609, Ma iling of P ersonally Identifiab le and VA Sensitive Informatio n | |
2582 | VHA Direct ive 1605, VHA Privac y Program | |
2583 | VHA Handbo ok 1605.1, Privacy a nd Release of Inform ation | |
2584 | VHA Handbo ok 1605.02 , Minimum Necessary Standard f or Protect ed Health Informatio n | |
2585 | ||
2586 | ||
2587 | Table 7. A dditional Selected V A Handbook s and Dire ctives | |
2588 | Available at: http:/ / DNS . URL /vapubs/in dex.cfm | |
2589 | VA Directi ve 0701, O ffice of I nspector G eneral Hot line Compl aint Refer rals | |
2590 | VA Directi ve 0735, H omeland Se curity Pre sidential Directive 12 (HSPD- | |
2591 | 12) Progra m | |
2592 | VA Directi ve 6515, U se of Web- Based Coll aboration Technologi es | |
2593 | ||
2594 | ||
2595 | Table 7. A dditional Selected V A Handbook s and Dire ctives | |
2596 | VA Handboo k 5011/5, Hours of D uty and Le ave | |
2597 | VA Handboo k 5011/26, August 9, 2013 Hour s of Duty and Leave | |
2598 | VA Handboo k 5021/3, Employee/M anagement Relations | |
2599 | VA Handboo k 5021.6, Employee/M anagement Relations, Appendix A | |
2600 | VA Handboo k 6300.1, Records Ma nagement P rocedures | |
2601 | VA Handboo k 6500, Ap pendix F, VA System Security C ontrols | |
2602 | VA Handboo k 6500.6, Contract S ecurity an d Appendix D, Contra ctor Rules of Behavi or | |
2603 | VA Directi ve 0701, O ffice of I nspector G eneral Hot line Compl aint Refer rals | |
2604 | VA Directi ve 0735, H omeland Se curity Pre sidential Directive 12 (HSPD- | |
2605 | 12) Progra m | |
2606 | VA Directi ve 6515, U se of Web- Based Coll aboration Technologi es | |
2607 | ||
2608 | ||
2609 | Table 8. F orms and M emorandums | |
2610 | Available at: http:/ / DNS . URL /vaforms/ | |
2611 | VA Form 02 44, Record s Transmit tal and Re ceipt | |
2612 | VA Form 07 40 New Tel ework Requ est Agreem ent, Aug 2 013 | |
2613 | VA Form 74 68, Reques t for Disp osition of Records | |
2614 | VAIQ 75814 92, Use of Personal Email | |
2615 | VAIQ 76330 50, Mandat ory Use of PIV Card Authentica tion for V A Informat ion System Access | |
2616 | VAIQ 77142 83, Modifi ed VA Info rmation Se curity Rul es of Beha vior, Augu st 24, 201 6 |
Araxis Merge (but not the data content of this report) is Copyright © 1993-2016 Araxis Ltd (www.araxis.com). All rights reserved.