certification that the Secretary has commenced each ac-
tion described in subsection (b). 
SEC. 5. UPGRADE OR PHASE-OUT OF UNSUPPORTED OR 
OUTDATED OPERATING SYSTEMS. 
(a) IN GENERAL.—Not later than 90 days after the 
date of the enactment of this Act, the Secretary shall en-
sure that the Secretary upgrades or phases out outdated 
or unsupported operating systems to protect computers of 
the Department from harmful viruses, spyware, and other 
malicious software that could affect the confidentiality of 
sensitive personal information of veterans. 
(b) ACTIONS REQUIRED.—In carrying out subsection 
(a), the Secretary shall carry out the following activities: 
(1) Establish a plan for phasing out outdated 
or unsupported operating systems used by the De-
partment. 
(2) Establish a policy to ensure that outdated 
and unsupported operating systems used by the De-
partment do not connect to the network of the De-
partment by not later than 15 days after the date 
on which such operating systems are so outdated or 
unsupported, as determined appropriate by the Sec-
retary. 
(3) Establish a configuration management proc-
ess to ensure that— 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(A) a secure image that is regularly up-
dated is used to build all new computers used 
by the Department; and 
(B) any computer used by the Department 
that becomes compromised is re-imaged using 
such image. 
(4) Implement applicable operating systems 
based on security guidance identified by the Infor-
mation Assurance Directorate of the National Secu-
rity Agency. 
(5) Appropriately configure and test required 
software that was designed to be used on older oper-
ating systems to ensure the software is usable on a 
new operating system used by the Department. 
(6) Limit administrative privileges to very few 
users who have both the appropriate knowledge and 
business need to modify the configuration of the op-
erating system. 
(7) Until the date on which an unsupported op-
erating system is replaced, if a computer uses such 
operating system, disable web browser plug-ins, use 
a hardware firewall, and if practicable, disconnect 
the computer from the network and do not use the 
computer to access the Internet. 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(8) Deploy a software inventory tool to cover 
each of the operating systems in use by the Depart-
ment to track— 
(A) the type of such operating systems 
being used by the Department; and 
(B) with respect to each computer of the 
Department— 
(i) the type of operating system in-
stalled and the version number and patch 
level of such operating system; and 
(ii) the software being used on such 
operating system. 
(9) Regularly use file integrity checking tools to 
check any changes to critical operating systems, 
services, and configuration files. 
(c) CERTIFICATION.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary shall 
submit to the congressional veterans committees written 
certification that the Secretary has commenced each ac-
tion described in subsection (b). 
SEC. 6. SECURITY OF WEB APPLICATIONS FROM VITAL 
VULNERABILITIES. 
(a) IN GENERAL.—The Secretary shall ensure that 
web applications used by the Department are secure from 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
vulnerabilities that could affect the confidentiality of sen-
sitive personal information of veterans. 
(b) ACTIONS REQUIRED.—In carrying out subsection 
(a), the Secretary shall carry out the following activities: 
(1) Not later than 60 days after the date of the 
enactment of this Act, develop a plan, including re-
quired actions and milestones, to fully remediate all 
security vulnerabilities described in subsection (a) 
that exist as of the date of the enactment of this 
Act. 
(2) Develop detailed guidance for remediating 
each critical security vulnerability. 
(3) Use best practices and lessons learned, in-
cluding such practices and lessons described by the 
National Institute of Standards and Technology and 
the Open Web Application Security Project, to ad-
dress the security vulnerabilities of web applications. 
(4) Limit the permissions on the database logon 
used by web applications to only what is needed to 
reduce the effectiveness of any attack that exploits 
bugs in the application. 
(5) Provide to web application developers— 
(A) 
thorough 
application 
development 
guidance to ensure that new applications are 
designed by taking into account security; and 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(B) detailed guidance on testing existing 
web applications for security vulnerabilities, in-
cluding buffer overflows and cross-site script-
ing. 
(6) Configure administrative passwords to be— 
(A) complex and consist only of strings of 
letters, numbers, and characters that do not 
form a recognizable word; and 
(B) changed every 90 days, in accordance 
with industry best practices. 
(7) With respect to passwords used in connec-
tion with web applications, store the passwords for 
each system of the Department only in a well-hashed 
or encrypted format. 
(8) Implement two-factor authentication tech-
nology requirements throughout the Department. 
(9) If vulnerabilities in a web application are 
found, administer a full-source code review to deter-
mine if the vulnerabilities exist elsewhere within the 
code of the application. 
(10) Periodically review user access to networks 
and web applications to identify unnecessary, inac-
tive, or terminated user accounts. 
(11) Establish a single set of strong authentica-
tion and session management controls that meet all 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS