Veterans Information Security Improvement Act
A BILL
To improve the information security of the Department of Veterans Affairs by directing the Secretary of Veterans Affairs to carry out certain actions to improve the transparency and the governance of the information security program of the Department, and for other purposes.
2. Governance of information security program of Department of Veterans Affairs
Requirements for certain officials and staff—
In general— Subchapter III of chapter 57 of title 38, United States Code, is amended by inserting after section 5723 the following new section:
“5723A. Governance of information security program
“(a) In general—The Secretary shall carry out this section to improve the transparency and the coordination of the information security program of the Department.
“(b) Office of Information and Technology
“(1) The Secretary shall ensure that the Assistant Secretary for Information and Technology, as the Chief Information Officer of the Department, possesses—
“(A) the appropriate education and at least 10 concurrent years of validated experience and capabilities in the management of information technology organizations;
“(B) an industry recognized certification in information security and cyber security defense; and
“(C) demonstrated, sound technical capabilities.
“(2) The Secretary shall ensure that the staff of the Office of Information and Technology who perform security functions, including the assessment and analysis of risk, security auditing, security operations, and security engineering, are assigned to the Office of Information Security.
“(3) The Secretary shall ensure that subordinate offices of the Office of Information and Technology, in coordination with the head of the Office of Information Security, maintain appropriate information security functions within each such office to—
“(A) incorporate secure software assurance processes into the software development lifecycle for all software development activities;
“(B) validate that each third-party developed software used in any information system of the Department meets the standards of the National Institute of Standards and Technology with respect to security, safety, reliability, functionality and extensibility;
“(C) maintain established information security baseline controls for such information systems, and immediately remediate systems determined to be out of compliance with established baseline controls to the maximum extent possible;
“(D) ensure that the security architecture of the Department is documented and fully integrated into the overall enterprise architecture strategy of the Department; and
“(E) develop and implement a policy that restricts the development of new data warehouses and data marts holding sensitive personal information of veterans and reduces the number of data marts holding such information.
“(c) Office of Information Security
“(1) The Secretary shall ensure that the head of the Office of Information Security possesses—
“(A) the appropriate education and at least 10 concurrent years of experience with respect to validated information security; and
“(B) an industry recognized certification in cyber security defense;
“(C) demonstrated, sound technical capabilities; and
“(D) other relevant experience.
“(2) The Secretary shall ensure that all of the field staff of the Office of Information Security, including relevant staff of the Office of Information Technology, whose primary responsibility is the protection of personally identifiable information of veterans maintain current information security training and possess a certain level of information security, cyber security defense, and technical capabilities and certifications as appropriate.”
Clerical amendment— The table of sections at the beginning of such chapter is amended by inserting after the item relating to section 5723 the following new item:
Definitions— Section 5721 of title 38, United States Code, is amended by adding at the end the following new paragraphs:
“(24) Data mart—The term data mart means a subset of a data warehouse that contains information for a specific department or entity of an organization rather than the entire organization.
“(25) Data warehouse—The term data warehouse means a collection of data designed to support management decision making that contains a wide variety of data that present a coherent picture of business conditions for an entire organization at a single point in time and whose development includes the development of systems to extract data from operating systems plus installation of a warehouse database system that provides managers flexible access to the data.”
3. Security of critical network infrastructure, including domain controller, of Department of Veterans Affairs
In general— Not later than 90 days after the date of the enactment of this Act, the Secretary of Veterans Affairs shall ensure the security and safeguard of the network infrastructure of the Department of Veterans Affairs.
Actions required— In carrying out subsection (a), the Secretary shall carry out the following actions:
Maintain the awareness and complete physical and logical control of the critical network infrastructure, including routers, switches, domain naming systems, firewalls, load balancers, proxy devices, authentication services, telecommunications, domain controllers, and any device that is part of the trusted Internet connection system.
If the Secretary determines that any critical network infrastructure device or service has been compromised, restore the device or service to the last known noncompromised state and determine the cause of the compromise.
If the Secretary determines that compromised devices or services must be used for a limited time, conduct such use in accordance with the guidance established by the National Security Agency under the document titled “Information Assurance Guidance for Operating on a Compromised Network”, or successor document.
Provide special security configurations for protecting critical infrastructure devices and services.
Implement policies and security measures that minimize the threats to critical infrastructure devices and services.
Ensure that critical infrastructure devices and services, including the domain controller settings, are in compliance with the Server Security Plan of the Department under the Department of Veterans Affairs Handbook 6500.
Establish access rights, permissions, and multifactor authentication for the critical infrastructure devices and services, including the domain controller, for specific users or groups of users.
Ensure that proper physical security measures are taken to safeguard the critical infrastructure devices and services and limit physical access to such location to a limited number of authorized individuals.
Limit the access from network connections to critical infrastructure devices and services and only configure services and software that are needed by the devices and services.
Disable or delete any service or software from critical infrastructure devices and services that is unnecessary.
Where feasible, secure critical infrastructure devices and services with host-based and networked-based security controls and limit the number of ports that are opened between critical infrastructure devices and services, including any device requesting access to network resources and services.
Conduct regular audits and testing of the backups and restore events of the critical infrastructure devices and services.
Ensure that for any device to access and communicate with critical infrastructure devices and services within the domain, the authentication traffic has to be signed and encrypted.
Limit the administrator account from accessing critical infrastructure devices and services, including domain controllers, throughout the network and use such account only for emergencies.
Restrict remote access to local administrator accounts and use firewall rules to restrict lateral movement on the network.
Conduct regular formal penetration testing to test for potential security weaknesses and resolve such weaknesses by not later than seven days after identifying such weaknesses.
Certification— Not later than 30 days after the date of the enactment of this Act, the Secretary shall submit to the congressional veterans committees written certification that the Secretary has commenced each action described in subsection (b).
4. Security of computers and servers of Department of Veterans Affairs
In general— The Secretary shall ensure the security of each general purpose computer and server of the Department.
Actions required— In carrying out subsection (a), the Secretary shall carry out the following actions:
Formalize and enforce a Department-wide process to monitor software installed on general purpose computers and servers of the Department, prevent the unauthorized installation of software, and remove any unauthorized software that has been installed.
Not later than 45 days after the date of the enactment of this Act, implement automated patching tools and processes that ensure that security patches are installed for any software or operating system on a computer by not later than 48 hours after the patch is made available.
Employ automated tools to continuously monitor general purpose computers, servers, and mobile devices for active, up-to-date anti-malware protection with antivirus, antispyware, personal firewalls, and host-based intrusion prevention system functionality.
Centralize oversight and control to effectively administer patch management processes (but the responsibility for testing and applying patches to specific systems may be decentralized to the component level).
Perform regular scans of general purpose computers and servers to discover security vulnerabilities and log the results of such scans.
Perform a patch-focused risk assessment to evaluate each system, database, and general purpose computer for threats, vulnerabilities, and its criticality to the mission of the Department.
If the Secretary determines any security vulnerability—
develop a test for the vulnerability and determine the cause of the vulnerability;
address the vulnerability, including by patching, implementing a compensating control, or documenting and accepting a reasonable business risk (in accordance with industry accepted best practices) with respect to the vulnerability; and
perform a post remediation scan to verify that the vulnerability was so addressed.
Establish and ensure the use of standard, secure configurations of each operating system in use on the computers of the Department.
Employ system-scanning tools that check computers daily for software version, patch levels, and configuration files.
Deploy a security content automation protocol tool that is validated by the National Institute of Standards and Technology to use specific standards to enable automated vulnerability management, measurement, and policy compliance evaluation.
Standardize policies, procedures, and tools for effective patch management, including by assigning roles and responsibilities, performing risk assessments, and testing patches.
Test each patch against all system configurations of the Department in a test environment to determine any effect on the network before deploying the patch to the affected systems and monitor the status of the patches after deployment.
Establish and maintain an inventory of all hardware equipment, software packages, services, and other technologies installed and used by the Department for patch management.
Establish a policy for security fixes that is clearly communicated to computer users to ensure that the users are aware of—
the versions of software or operating systems that are supported with respect to security fixes; and
when software, operating systems, or other products are scheduled to no longer be maintained.
Ensure that—
the staff or contractors of the Department who are involved in patch management have the skills and knowledge needed to perform the responsibilities relating to such management; and
system administrators are trained in identifying new patches and vulnerabilities.
Certification— Not later than 30 days after the date of the enactment of this Act, the Secretary shall submit to the congressional veterans committees written certification that the Secretary has commenced each action described in subsection (b).
5. Upgrade or phase-out of unsupported or outdated operating systems
In general— Not later than 90 days after the date of the enactment of this Act, the Secretary shall ensure that the Secretary upgrades or phases out outdated or unsupported operating systems to protect computers of the Department from harmful viruses, spyware, and other malicious software that could affect the confidentiality of sensitive personal information of veterans.
Actions required— In carrying out subsection (a), the Secretary shall carry out the following activities:
Establish a plan for phasing out outdated or unsupported operating systems used by the Department.
Establish a policy to ensure that outdated and unsupported operating systems used by the Department do not connect to the network of the Department by not later than 15 days after the date on which such operating systems are so outdated or unsupported, as determined appropriate by the Secretary.
Establish a configuration management process to ensure that—
a secure image that is regularly updated is used to build all new computers used by the Department; and
any computer used by the Department that becomes compromised is re-imaged using such image.
Implement applicable operating systems based on security guidance identified by the Information Assurance Directorate of the National Security Agency.
Appropriately configure and test required software that was designed to be used on older operating systems to ensure the software is usable on a new operating system used by the Department.
Limit administrative privileges to very few users who have both the appropriate knowledge and business need to modify the configuration of the operating system.
Until the date on which an unsupported operating system is replaced, if a computer uses such operating system, disable web browser plug-ins, use a hardware firewall, and if practicable, disconnect the computer from the network and do not use the computer to access the Internet.
Deploy a software inventory tool to cover each of the operating systems in use by the Department to track—
the type of such operating systems being used by the Department; and
with respect to each computer of the Department—
the type of operating system installed and the version number and patch level of such operating system; and
the software being used on such operating system.
Regularly use file integrity checking tools to check any changes to critical operating systems, services, and configuration files.
Certification— Not later than 30 days after the date of the enactment of this Act, the Secretary shall submit to the congressional veterans committees written certification that the Secretary has commenced each action described in subsection (b).
6. Security of web applications from vital vulnerabilities
In general— The Secretary shall ensure that web applications used by the Department are secure from vulnerabilities that could affect the confidentiality of sensitive personal information of veterans.
Actions required— In carrying out subsection (a), the Secretary shall carry out the following activities:
Not later than 60 days after the date of the enactment of this Act, develop a plan, including required actions and milestones, to fully remediate all security vulnerabilities described in subsection (a) that exist as of the date of the enactment of this Act.
Develop detailed guidance for remediating each critical security vulnerability.
Use best practices and lessons learned, including such practices and lessons described by the National Institute of Standards and Technology and the Open Web Application Security Project, to address the security vulnerabilities of web applications.
Limit the permissions on the database logon used by web applications to only what is needed to reduce the effectiveness of any attack that exploits bugs in the application.
Provide to web application developers—
thorough application development guidance to ensure that new applications are designed by taking into account security; and
detailed guidance on testing existing web applications for security vulnerabilities, including buffer overflows and cross-site scripting.
Configure administrative passwords to be—
complex and consist only of strings of letters, numbers, and characters that do not form a recognizable word; and
changed every 90 days, in accordance with industry best practices.
With respect to passwords used in connection with web applications, store the passwords for each system of the Department only in a well-hashed or encrypted format.
Implement two-factor authentication technology requirements throughout the Department.
If vulnerabilities in a web application are found, administer a full-source code review to determine if the vulnerabilities exist elsewhere within the code of the application.
Periodically review user access to networks and web applications to identify unnecessary, inactive, or terminated user accounts.
Establish a single set of strong authentication and session management controls that meet all the authentication and session management requirements defined in the Application Security Verification Standard of the Open Web Application Security Project.
Implement visibility and attribution measures to improve the process, architecture, and technical capabilities of the Department to monitor web applications used on the networks and computers of the Department to detect attack attempts, locate points of entry, identify already compromised machines, interrupt activities of infiltrated attackers, and gain information about the sources of an attack.
Certification— Not later than 30 days after the date of the enactment of this Act, the Secretary shall submit to the congressional veterans committees written certification that the Secretary has commenced each action described in subsection (b).
7. Security of the Vista system
In general— Not later than 90 days after the date of the enactment of this Act, the Secretary shall ensure that the Vista system is secure from vulnerabilities that could affect the confidentiality of sensitive personal information of veterans.
Actions required— In carrying out subsection (a), the Secretary shall carry out the following activities:
Develop a remedial action plan to address the approaches to interoperability—
between multiple Vista systems; and
between the Vista system and external systems and software.
Update the policy, procedures, and governance of the Department with respect to system-to-system integration where users log on to external systems and then automatically connect to the Vista system and interact.
Provide authentication for the machine-to-machine broker so that the Vista system “listener” verifies the identity of the calling system.
Establish and implement policy with respect to the authentication of external systems attempting to connect to the Vista system and criteria by which user authentication must be accomplished to ensure all applications that connect to the Vista system convey accurate user information.
Establish a business requirement that system-to-system integration connectivity across the wide-area network must consist of encrypted communication and require external systems to securely identify themselves, or for the Vista system to securely identify external systems that attempt to connect to the system.
Establish a business requirement that external systems communicate accurate user information to the Vista system relating to actions initiated by actual individuals and facilitate the revocation of access by the Vista system relative to specific users or external systems attempting to connect.
Implement monthly project design reviews of the integration between systems and web applications to ensure that the effectiveness of the existing controls is sustained.
Assess the potential compromise to non-Department networks that are interconnected with the network of the Department, including the networks of the Department of Defense and the Department of Health and Human Services.
Ensure that, in the near-term, software development for the Vista system develops the critical enhancements and fixes to the system that are necessary to ensure compliance with changes to patient enrollment.
Ensure that all systems of the Department have been given the Authority to Operate designation and have been properly certified by meeting all requirements, including a comprehensive assessment of management, operational, and technical security controls, to become operational, and restrict the use of waivers.
Certification— Not later than 30 days after the date of the enactment of this Act, the Secretary shall submit to the congressional veterans committees written certification that the Secretary has commenced each action described in subsection (b).
8. Report on compliance with information security requirements and best practices
Not later than 60 days after the date of the enactment of this Act, the Secretary of Veterans Affairs shall submit to the congressional veterans committees the following:
Written certification that the Secretary is taking every action required to comply with—
subchapter III of chapter 57 of title 38, United States Code;
subchapter III of chapter 35 of title 44, United States Code;
special publications 800–53 and 800–111 of the National Institute of Standards and Technology, including with respect to encrypting databases;
applicable memoranda issued by the Director of Management and Budget regarding protecting personally identifiable information; and
any other relevant law or regulation regarding the information security of the Department of Veterans Affairs.
How the Secretary is using and implementing the principles and best practices regarding improving information security, including with respect to such principles and practices described in the document titled “Framework for Improving Critical Infrastructure Cybersecurity” of the National Institute of Standards and Technology.
9. Reports on implementation
Biannual reports—
In general— Not later than 180 days after the date of the enactment of this Act, and every 180-day period thereafter, the Secretary shall submit to the congressional veterans committees a report on the implementation of this Act, including the amendments made by this Act.
Matters included— Each report under subsection (a) shall include the following:
A description of the actions taken by the Secretary to implement and comply with sections 2 through 7.
A timeline and project plan, both short-term and long-term, for implementing each of sections 2 through 7 and assigning roles and responsibilities under such plan.
Performance measures and benchmarks to measure the results of the Secretary in carrying out remediation efforts under sections 2 through 7.
A description of the best practices and lessons learned by the Secretary in carrying out sections 2 through 7.
The progress made by the Secretary during each month covered by the report with respect to reducing the total number of outdated operating systems, web application vulnerabilities, critical security vulnerabilities, and other matters covered by sections 2 through 7.
An appendix containing detailed reports of the Department, including the enterprise information technology dashboard and reports regarding security vulnerabilities, operating system trends, and web applications.
Annual Inspector General report— The Inspector General of the Department of Veterans Affairs shall submit to the congressional veterans committees an annual report that includes a comprehensive assessment of the adequacy and effectiveness of the implementation by the Secretary of Veterans Affairs of sections 2 through 7, including the amendments made by this Act.
Monthly reports— On a monthly basis, the Secretary shall submit to the congressional veterans committees reports on security vulnerabilities discovered pursuant to the actions taken under section 4(b)(5).
10. Application
In carrying out this Act, including the amendments made by this Act, the Secretary of Veterans Affairs may substitute a new technology or process relating to information security for a specific technology or process relating to information security described in this Act, including the amendments made by this Act, if the Secretary determines that such new technology or process—
is a successor to the specific technology or process described in this Act, including the amendments made by this Act; and
provides a greater amount of information security than would be provided if the Secretary did not make such substitution.
11. Definitions
In this Act:
The term Authority to Operate means the official management decision given by a senior official of the Department to authorize operation of an information system and to explicitly accept the risk to the operations of the Department (including with respect to the mission, functions, image, or reputation of the Department), the assets and individuals of the Department, other elements of the Federal Government, and the United States based on the implementation of an agreed-upon set of security controls.
The terms confidentiality has the meaning given that term in section 5727 of title 38, United States Code.
The term congressional veterans committees means the Committees on Veterans’ Affairs of the House of Representatives and the Senate.
The term critical network infrastructure means information technology hardware that provides—
vital network services to the Department that is vital to carrying out the mission of the Department; and
communications, security, transportation, access, and authentication services and capabilities.
The term domain controller means a server that responds to security authentication requests responsible for allowing host access to domain resources by authenticating users, sorting user account information, and enforcing security policy.
The term general purpose computer means a computer that, given the appropriate application and required time, should be able to perform most common computing tasks. Such term includes personal computers, including desktops, notebooks, smart phones, and tablets.
The term image means a standard set of software (including the operating system and other software) that is installed on a computer.
The term information security has the meaning given that term in section 5727 of title 38, United States Code.
The term information system has the meaning given that term in section 5727 of title 38, United States Code.
The term sensitive personal information has the meaning given that term in section 5727 of title 38, United States Code.
The term Vista system means the Veterans Health Information Systems and Technology Architecture of the Department of Veterans Affairs that allows for an integrated inpatient and outpatient electronic health record for patients and provides administrative tools to employees of the Department.
The term web application means an application in which all or some parts of the software are downloaded from the Internet each time the software is accessed, including web browser-based software that run within a web browser, desktop software that does not use a web browser, and mobile software that accesses the Internet for additional information.
The term well-hashed means the process of using a mathematical algorithm against data to produce a numeric value that is representative of that data.