,i #aacth ,,congress #b;d ,session ,h4 ,r4 #dcgj ,,in ,,the ,,house ,,of ,,representatives ,april #b1 #bjad ,mrs4 ,walorski 7for herself1 ,mr4 ,coffman1 ,mr4 ,wenstrup1 and ,mr4 ,nugent7 introduced the following bill2 which was referred to the ,committee on ,veterans' ,affairs ,a ,,bill ,to improve the information security of the ,department of ,veterans ,affairs by directing the ,secretary of ,veterans ,affairs to carry out certain actions to improve the transparency and the governance of the information security program of the ,department1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,veterans ,information ,security ,improvement ,act4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,sec4 #b4 ,governance of information security program of ,department of ,veterans ,affairs4 ,sec4 #c4 ,security of critical network infrastructure1 including domain controller1 of ,department of ,veterans ,affairs4 ,sec4 #d4 ,security of computers and servers of ,department of ,veterans ,affairs4 ,sec4 #e4 ,upgrade or phase-out of unsupported or outdated operating systems4 ,sec4 #f4 ,security of web applications from vital vulnerabilities4 ,sec4 #g4 ,security of the ,vista system4 ,sec4 #h4 ,report on compliance with information security requirements and best practices4 ,sec4 #i4 ,reports on implementation4 ,sec4 #aj4 ,application4 ,sec4 #aa4 ,definitions4 #b4 ,governance of information security program of ,department of ,veterans ,affairs 7a7 ,requirements for certain officials and staff 7#a7 ,in general ,subchapter ,,iii of chapter #eg of title #ch1 ,united ,states ,code1 is amended by inserting after section #egbc the following new section3 #egbc;,a4 ,governance of information security program 7a7 ,in general ,the ,secretary shall carry out this section to improve the transparency and the coordination of the information security program of the ,department4 7b7 ,office of ,information and ,technology 7#a7 ,the ,secretary shall ensure that the ,assistant ,secretary for ,information and ,technology1 as the ,chief ,information ,officer of the ,department1 possesses-- 7,a7 the appropriate education and at least #aj concurrent years of validated experience and capabilities in the management of information technology organizations2 7,b7 an industry recognized certification in information security and cyber security defense2 and 7,c7 demonstrated1 sound technical capabilities4 7#b7 ,the ,secretary shall ensure that the staff of the ,office of ,information and ,technology who perform security functions1 including the assessment and analysis of risk1 security auditing1 security operations1 and security engineering1 are assigned to the ,office of ,information ,security4 7#c7 ,the ,secretary shall ensure that subordinate offices of the ,office of ,information and ,technology1 in coordination with the head of the ,office of ,information ,security1 maintain appropriate information security functions within each such office to-- 7,a7 incorporate secure software assurance processes into the software development lifecycle for all software development activities2 7,b7 validate that each third-party developed software used in any information system of the ,department meets the standards of the ,national ,institute of ,standards and ,technology with respect to security1 safety1 reliability1 functionality and extensibility2 7,c7 maintain established information security baseline controls for such information systems1 and immediately remediate systems determined to be out of compliance with established baseline controls to the maximum extent possible2 7,d7 ensure that the security architecture of the ,department is documented and fully integrated into the overall enterprise architecture strategy of the ,department2 and 7,e7 develop and implement a policy that restricts the development of new data warehouses and data marts holding sensitive personal information of veterans and reduces the number of data marts holding such information4 7c7 ,office of ,information ,security 7#a7 ,the ,secretary shall ensure that the head of the ,office of ,information ,security possesses-- 7,a7 the appropriate education and at least #aj concurrent years of experience with respect to validated information security2 and 7,b7 an industry recognized certification in cyber security defense2 7,c7 demonstrated1 sound technical capabilities2 and 7,d7 other relevant experience4 7#b7 ,the ,secretary shall ensure that all of the field staff of the ,office of ,information ,security1 including relevant staff of the ,office of ,information ,technology1 whose primary responsibility is the protection of personally identifiable information of veterans maintain current information security training and possess a certain level of information security1 cyber security defense1 and technical capabilities and certifications as appropriate4 4 7#b7 ,clerical amendment ,the table of sections at the beginning of such chapter is amended by inserting after the item relating to section #egbc the following new item3 #egbc;,a4 ,governance of information security program4 4 7b7 ,definitions ,section #egba of title #ch1 ,united ,states ,code1 is amended by adding at the end the following new paragraphs3 7#bd7 ,data mart ,the term data mart means a subset of a data warehouse that contains information for a specific department or entity of an organization rather than the entire organization4 7#be7 ,data warehouse ,the term data warehouse means a collection of data designed to support management decision making that contains a wide variety of data that present a coherent picture of business conditions for an entire organization at a single point in time and whose development includes the development of systems to extract data from operating systems plus installation of a warehouse database system that provides managers flexible access to the data4 4 #c4 ,security of critical network infrastructure1 including domain controller1 of ,department of ,veterans ,affairs 7a7 ,in general ,not later than #ij days after the date of the enactment of this ,act1 the ,secretary of ,veterans ,affairs shall ensure the security and safeguard of the network infrastructure of the ,department of ,veterans ,affairs4 7b7 ,actions required ,in carrying out subsection 7a71 the ,secretary shall carry out the following actions3 7#a7 ,maintain the awareness and complete physical and logical control of the critical network infrastructure1 including routers1 switches1 domain naming systems1 firewalls1 load balancers1 proxy devices1 authentication services1 telecommunications1 domain controllers1 and any device that is part of the trusted ,internet connection system4 7#b7 ,if the ,secretary determines that any critical network infrastructure device or service has been compromised1 restore the device or service to the last known noncompromised state and determine the cause of the compromise4 7#c7 ,if the ,secretary determines that compromised devices or services must be used for a limited time1 conduct such use in accordance with the guidance established by the ,national ,security ,agency under the document titled ,information ,assurance ,guidance for ,operating on a ,compromised ,network1 or successor document4 7#d7 ,provide special security configurations for protecting critical infrastructure devices and services4 7#e7 ,implement policies and security measures that minimize the threats to critical infrastructure devices and services4 7#f7 ,ensure that critical infrastructure devices and services1 including the domain controller settings1 are in compliance with the ,server ,security ,plan of the ,department under the ,department of ,veterans ,affairs ,handbook #fejj4 7#g7 ,establish access rights1 permissions1 and multifactor authentication for the critical infrastructure devices and services1 including the domain controller1 for specific users or groups of users4 7#h7 ,ensure that proper physical security measures are taken to safeguard the critical infrastructure devices and services and limit physical access to such location to a limited number of authorized individuals4 7#i7 ,limit the access from network connections to critical infrastructure devices and services and only configure services and software that are needed by the devices and services4 7#aj7 ,disable or delete any service or software from critical infrastructure devices and services that is unnecessary4 7#aa7 ,where feasible1 secure critical infrastructure devices and services with host-based and networked-based security controls and limit the number of ports that are opened between critical infrastructure devices and services1 including any device requesting access to network resources and services4 7#ab7 ,conduct regular audits and testing of the backups and restore events of the critical infrastructure devices and services4 7#ac7 ,ensure that for any device to access and communicate with critical infrastructure devices and services within the domain1 the authentication traffic has to be signed and encrypted4 7#ad7 ,limit the administrator account from accessing critical infrastructure devices and services1 including domain controllers1 throughout the network and use such account only for emergencies4 7#ae7 ,restrict remote access to local administrator accounts and use firewall rules to restrict lateral movement on the network4 7#af7 ,conduct regular formal penetration testing to test for potential security weaknesses and resolve such weaknesses by not later than seven days after identifying such weaknesses4 7c7 ,certification ,not later than #cj days after the date of the enactment of this ,act1 the ,secretary shall submit to the congressional veterans committees written certification that the ,secretary has commenced each action described in subsection 7b74 #d4 ,security of computers and servers of ,department of ,veterans ,affairs 7a7 ,in general ,the ,secretary shall ensure the security of each general purpose computer and server of the ,department4 7b7 ,actions required ,in carrying out subsection 7a71 the ,secretary shall carry out the following actions3 7#a7 ,formalize and enforce a ,department-wide process to monitor software installed on general purpose computers and servers of the ,department1 prevent the unauthorized installation of software1 and remove any unauthorized software that has been installed4 7#b7 ,not later than #de days after the date of the enactment of this ,act1 implement automated patching tools and processes that ensure that security patches are installed for any software or operating system on a computer by not later than #dh hours after the patch is made available4 7#c7 ,employ automated tools to continuously monitor general purpose computers1 servers1 and mobile devices for active1 up-to-date anti-malware protection with antivirus1 antispyware1 personal firewalls1 and host-based intrusion prevention system functionality4 7#d7 ,centralize oversight and control to effectively administer patch management processes 7but the responsibility for testing and applying patches to specific systems may be decentralized to the component level74 7#e7 ,perform regular scans of general purpose computers and servers to discover security vulnerabilities and log the results of such scans4 7#f7 ,perform a patch-focused risk assessment to evaluate each system1 database1 and general purpose computer for threats1 vulnerabilities1 and its criticality to the mission of the ,department4 7#g7 ,if the ,secretary determines any security vulnerability-- 7,a7 develop a test for the vulnerability and determine the cause of the vulnerability2 7,b7 address the vulnerability1 including by patching1 implementing a compensating control1 or documenting and accepting a reasonable business risk 7in accordance with industry accepted best practices7 with respect to the vulnerability2 and 7,c7 perform a post remediation scan to verify that the vulnerability was so addressed4 7#h7 ,establish and ensure the use of standard1 secure configurations of each operating system in use on the computers of the ,department4 7#i7 ,employ system-scanning tools that check computers daily for software version1 patch levels1 and configuration files4 7#aj7 ,deploy a security content automation protocol tool that is validated by the ,national ,institute of ,standards and ,technology to use specific standards to enable automated vulnerability management1 measurement1 and policy compliance evaluation4 7#aa7 ,standardize policies1 procedures1 and tools for effective patch management1 including by assigning roles and responsibilities1 performing risk assessments1 and testing patches4 7#ab7 ,test each patch against all system configurations of the ,department in a test environment to determine any effect on the network before deploying the patch to the affected systems and monitor the status of the patches after deployment4 7#ac7 ,establish and maintain an inventory of all hardware equipment1 software packages1 services1 and other technologies installed and used by the ,department for patch management4 7#ad7 ,establish a policy for security fixes that is clearly communicated to computer users to ensure that the users are aware of-- 7,a7 the versions of software or operating systems that are supported with respect to security fixes2 and 7,b7 when software1 operating systems1 or other products are scheduled to no longer be maintained4 7#ae7 ,ensure that-- 7,a7 the staff or contractors of the ,department who are involved in patch management have the skills and knowledge needed to perform the responsibilities relating to such management2 and 7,b7 system administrators are trained in identifying new patches and vulnerabilities4 7c7 ,certification ,not later than #cj days after the date of the enactment of this ,act1 the ,secretary shall submit to the congressional veterans committees written certification that the ,secretary has commenced each action described in subsection 7b74 #e4 ,upgrade or phase-out of unsupported or outdated operating systems 7a7 ,in general ,not later than #ij days after the date of the enactment of this ,act1 the ,secretary shall ensure that the ,secretary upgrades or phases out outdated or unsupported operating systems to protect computers of the ,department from harmful viruses1 spyware1 and other malicious software that could affect the confidentiality of sensitive personal information of veterans4 7b7 ,actions required ,in carrying out subsection 7a71 the ,secretary shall carry out the following activities3 7#a7 ,establish a plan for phasing out outdated or unsupported operating systems used by the ,department4 7#b7 ,establish a policy to ensure that outdated and unsupported operating systems used by the ,department do not connect to the network of the ,department by not later than #ae days after the date on which such operating systems are so outdated or unsupported1 as determined appropriate by the ,secretary4 7#c7 ,establish a configuration management process to ensure that-- 7,a7 a secure image that is regularly updated is used to build all new computers used by the ,department2 and 7,b7 any computer used by the ,department that becomes compromised is re-imaged using such image4 7#d7 ,implement applicable operating systems based on security guidance identified by the ,information ,assurance ,directorate of the ,national ,security ,agency4 7#e7 ,appropriately configure and test required software that was designed to be used on older operating systems to ensure the software is usable on a new operating system used by the ,department4 7#f7 ,limit administrative privileges to very few users who have both the appropriate knowledge and business need to modify the configuration of the operating system4 7#g7 ,until the date on which an unsupported operating system is replaced1 if a computer uses such operating system1 disable web browser plug-ins1 use a hardware firewall1 and if practicable1 disconnect the computer from the network and do not use the computer to access the ,internet4 7#h7 ,deploy a software inventory tool to cover each of the operating systems in use by the ,department to track-- 7,a7 the type of such operating systems being used by the ,department2 and 7,b7 with respect to each computer of the ,department-- 7i7 the type of operating system installed and the version number and patch level of such operating system2 and 7ii7 the software being used on such operating system4 7#i7 ,regularly use file integrity checking tools to check any changes to critical operating systems1 services1 and configuration files4 7c7 ,certification ,not later than #cj days after the date of the enactment of this ,act1 the ,secretary shall submit to the congressional veterans committees written certification that the ,secretary has commenced each action described in subsection 7b74 #f4 ,security of web applications from vital vulnerabilities 7a7 ,in general ,the ,secretary shall ensure that web applications used by the ,department are secure from vulnerabilities that could affect the confidentiality of sensitive personal information of veterans4 7b7 ,actions required ,in carrying out subsection 7a71 the ,secretary shall carry out the following activities3 7#a7 ,not later than #fj days after the date of the enactment of this ,act1 develop a plan1 including required actions and milestones1 to fully remediate all security vulnerabilities described in subsection 7a7 that exist as of the date of the enactment of this ,act4 7#b7 ,develop detailed guidance for remediating each critical security vulnerability4 7#c7 ,use best practices and lessons learned1 including such practices and lessons described by the ,national ,institute of ,standards and ,technology and the ,open ,web ,application ,security ,project1 to address the security vulnerabilities of web applications4 7#d7 ,limit the permissions on the database logon used by web applications to only what is needed to reduce the effectiveness of any attack that exploits bugs in the application4 7#e7 ,provide to web application developers-- 7,a7 thorough application development guidance to ensure that new applications are designed by taking into account security2 and 7,b7 detailed guidance on testing existing web applications for security vulnerabilities1 including buffer overflows and cross-site scripting4 7#f7 ,configure administrative passwords to be-- 7,a7 complex and consist only of strings of letters1 numbers1 and characters that do not form a recognizable word2 and 7,b7 changed every #ij days1 in accordance with industry best practices4 7#g7 ,with respect to passwords used in connection with web applications1 store the passwords for each system of the ,department only in a well-hashed or encrypted format4 7#h7 ,implement two-factor authentication technology requirements throughout the ,department4 7#i7 ,if vulnerabilities in a web application are found1 administer a full-source code review to determine if the vulnerabilities exist elsewhere within the code of the application4 7#aj7 ,periodically review user access to networks and web applications to identify unnecessary1 inactive1 or terminated user accounts4 7#aa7 ,establish a single set of strong authentication and session management controls that meet all the authentication and session management requirements defined in the ,application ,security ,verification ,standard of the ,open ,web ,application ,security ,project4 7#ab7 ,implement visibility and attribution measures to improve the process1 architecture1 and technical capabilities of the ,department to monitor web applications used on the networks and computers of the ,department to detect attack attempts1 locate points of entry1 identify already compromised machines1 interrupt activities of infiltrated attackers1 and gain information about the sources of an attack4 7c7 ,certification ,not later than #cj days after the date of the enactment of this ,act1 the ,secretary shall submit to the congressional veterans committees written certification that the ,secretary has commenced each action described in subsection 7b74 #g4 ,security of the ,vista system 7a7 ,in general ,not later than #ij days after the date of the enactment of this ,act1 the ,secretary shall ensure that the ,vista system is secure from vulnerabilities that could affect the confidentiality of sensitive personal information of veterans4 7b7 ,actions required ,in carrying out subsection 7a71 the ,secretary shall carry out the following activities3 7#a7 ,develop a remedial action plan to address the approaches to interoperability-- 7,a7 between multiple ,vista systems2 and 7,b7 between the ,vista system and external systems and software4 7#b7 ,update the policy1 procedures1 and governance of the ,department with respect to system-to-system integration where users log on to external systems and then automatically connect to the ,vista system and interact4 7#c7 ,provide authentication for the machine-to-machine broker so that the ,vista system listener verifies the identity of the calling system4 7#d7 ,establish and implement policy with respect to the authentication of external systems attempting to connect to the ,vista system and criteria by which user authentication must be accomplished to ensure all applications that connect to the ,vista system convey accurate user information4 7#e7 ,establish a business requirement that system-to-system integration connectivity across the wide-area network must consist of encrypted communication and require external systems to securely identify themselves1 or for the ,vista system to securely identify external systems that attempt to connect to the system4 7#f7 ,establish a business requirement that external systems communicate accurate user information to the ,vista system relating to actions initiated by actual individuals and facilitate the revocation of access by the ,vista system relative to specific users or external systems attempting to connect4 7#g7 ,implement monthly project design reviews of the integration between systems and web applications to ensure that the effectiveness of the existing controls is sustained4 7#h7 ,assess the potential compromise to non-,department networks that are interconnected with the network of the ,department1 including the networks of the ,department of ,defense and the ,department of ,health and ,human ,services4 7#i7 ,ensure that1 in the near-term1 software development for the ,vista system develops the critical enhancements and fixes to the system that are necessary to ensure compliance with changes to patient enrollment4 7#aj7 ,ensure that all systems of the ,department have been given the ,authority to ,operate designation and have been properly certified by meeting all requirements1 including a comprehensive assessment of management1 operational1 and technical security controls1 to become operational1 and restrict the use of waivers4 7c7 ,certification ,not later than #cj days after the date of the enactment of this ,act1 the ,secretary shall submit to the congressional veterans committees written certification that the ,secretary has commenced each action described in subsection 7b74 #h4 ,report on compliance with information security requirements and best practices ,not later than #fj days after the date of the enactment of this ,act1 the ,secretary of ,veterans ,affairs shall submit to the congressional veterans committees the following3 7#a7 ,written certification that the ,secretary is taking every action required to comply with-- 7,a7 subchapter ,,iii of chapter #eg of title #ch1 ,united ,states ,code2 7,b7 subchapter ,,iii of chapter #ce of title #dd1 ,united ,states ,code2 7,c7 special publications #hjj-ec and #hjj-aaa of the ,national ,institute of ,standards and ,technology1 including with respect to encrypting databases2 7,d7 applicable memoranda issued by the ,director of ,management and ,budget regarding protecting personally identifiable information2 and 7,e7 any other relevant law or regulation regarding the information security of the ,department of ,veterans ,affairs4 7#b7 ,how the ,secretary is using and implementing the principles and best practices regarding improving information security1 including with respect to such principles and practices described in the document titled ,framework for ,improving ,critical ,infrastructure ,cybersecurity of the ,national ,institute of ,standards and ,technology4 #i4 ,reports on implementation 7a7 ,biannual reports 7#a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 and every #ahj-;day period thereafter1 the ,secretary shall submit to the congressional veterans committees a report on the implementation of this ,act1 including the amendments made by this ,act4 7#b7 ,matters included ,each report under subsection 7a7 shall include the following3 7,a7 ,a description of the actions taken by the ,secretary to implement and comply with sections #b through #g4 7,b7 ,a timeline and project plan1 both short-term and long-term1 for implementing each of sections #b through #g and assigning roles and responsibilities under such plan4 7,c7 ,performance measures and benchmarks to measure the results of the ,secretary in carrying out remediation efforts under sections #b through #g4 7,d7 ,a description of the best practices and lessons learned by the ,secretary in carrying out sections #b through #g4 7,e7 ,the progress made by the ,secretary during each month covered by the report with respect to reducing the total number of outdated operating systems1 web application vulnerabilities1 critical security vulnerabilities1 and other matters covered by sections #b through #g4 7,f7 ,an appendix containing detailed reports of the ,department1 including the enterprise information technology dashboard and reports regarding security vulnerabilities1 operating system trends1 and web applications4 7b7 ,annual ,inspector ,general report ,the ,inspector ,general of the ,department of ,veterans ,affairs shall submit to the congressional veterans committees an annual report that includes a comprehensive assessment of the adequacy and effectiveness of the implementation by the ,secretary of ,veterans ,affairs of sections #b through #g1 including the amendments made by this ,act4 7c7 ,monthly reports ,on a monthly basis1 the ,secretary shall submit to the congressional veterans committees reports on security vulnerabilities discovered pursuant to the actions taken under section #d7;b77#e74 #aj4 ,application ,in carrying out this ,act1 including the amendments made by this ,act1 the ,secretary of ,veterans ,affairs may substitute a new technology or process relating to information security for a specific technology or process relating to information security described in this ,act1 including the amendments made by this ,act1 if the ,secretary determines that such new technology or process-- 7#a7 is a successor to the specific technology or process described in this ,act1 including the amendments made by this ,act2 and 7#b7 provides a greater amount of information security than would be provided if the ,secretary did not make such substitution4 #aa4 ,definitions ,in this ,act3 7#a7 ,the term ,authority to ,operate means the official management decision given by a senior official of the ,department to authorize operation of an information system and to explicitly accept the risk to the operations of the ,department 7including with respect to the mission1 functions1 image1 or reputation of the ,department71 the assets and individuals of the ,department1 other elements of the ,federal ,government1 and the ,united ,states based on the implementation of an agreed-upon set of security controls4 7#b7 ,the terms confidentiality has the meaning given that term in section #egbg of title #ch1 ,united ,states ,code4 7#c7 ,the term congressional veterans committees means the ,committees on ,veterans' ,affairs of the ,house of ,representatives and the ,senate4 7#d7 ,the term critical network infrastructure means information technology hardware that provides-- 7,a7 vital network services to the ,department that is vital to carrying out the mission of the ,department2 and 7,b7 communications1 security1 transportation1 access1 and authentication services and capabilities4 7#e7 ,the term domain controller means a server that responds to security authentication requests responsible for allowing host access to domain resources by authenticating users1 sorting user account information1 and enforcing security policy4 7#f7 ,the term general purpose computer means a computer that1 given the appropriate application and required time1 should be able to perform most common computing tasks4 ,such term includes personal computers1 including desktops1 notebooks1 smart phones1 and tablets4 7#g7 ,the term image means a standard set of software 7including the operating system and other software7 that is installed on a computer4 7#h7 ,the term information security has the meaning given that term in section #egbg of title #ch1 ,united ,states ,code4 7#i7 ,the term information system has the meaning given that term in section #egbg of title #ch1 ,united ,states ,code4 7#aj7 ,the term sensitive personal information has the meaning given that term in section #egbg of title #ch1 ,united ,states ,code4 7#aa7 ,the term ,vista system means the ,veterans ,health ,information ,systems and ,technology ,architecture of the ,department of ,veterans ,affairs that allows for an integrated inpatient and outpatient electronic health record for patients and provides administrative tools to employees of the ,department4 7#ab7 ,the term web application means an application in which all or some parts of the software are downloaded from the ,internet each time the software is accessed1 including web browser-based software that run within a web browser1 desktop software that does not use a web browser1 and mobile software that accesses the ,internet for additional information4 7#ac7 ,the term well-hashed means the process of using a mathematical algorithm against data to produce a numeric value that is representative of that data4