SEC. 3. SECURITY OF CRITICAL NETWORK INFRASTRUC-
TURE, INCLUDING DOMAIN CONTROLLER, OF 
DEPARTMENT OF VETERANS AFFAIRS. 
(a) IN GENERAL.—Not later than 90 days after the 
date of the enactment of this Act, the Secretary of Vet-
erans Affairs shall ensure the security and safeguard of 
the network infrastructure of the Department of Veterans 
Affairs. 
(b) ACTIONS REQUIRED.—In carrying out subsection 
(a), the Secretary shall carry out the following preventive 
actions: 
(1) Maintain the awareness and complete phys-
ical and logical control of the critical network infra-
structure, including routers, switches, domain nam-
ing systems, firewalls, load balancers, proxy devices, 
authentication services, telecommunications, domain 
controllers, and any device that is part of the trust-
ed Internet connection system. 
(2) Provide special security configurations for 
protecting critical infrastructure devices and serv-
ices. 
(3) Implement policies and security measures 
that minimize the threats to critical infrastructure 
devices and services. 
(4) Ensure that critical infrastructure devices 
and services, including the domain controller set-
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
tings, are in compliance with the Server Security 
Plan of the Department under the Department of 
Veterans Affairs Handbook 6500. 
(5) Establish access rights, permissions, and 
multifactor authentication for the critical infrastruc-
ture devices and services, including the domain con-
troller, for specific users or groups of users. 
(6) Ensure that proper physical security meas-
ures are taken to safeguard the critical infrastruc-
ture devices and services and limit physical access to 
such location to a limited number of authorized indi-
viduals. 
(7) Limit the access from network connections 
to critical infrastructure devices and services and 
only configure services and software that are needed 
by the devices and services. 
(8) Disable or delete any service or software 
from critical infrastructure devices and services that 
is unnecessary. 
(9) Where feasible, secure critical infrastructure 
devices and services with host-based and networked- 
based security controls and limit the number of 
ports that are opened between critical infrastructure 
devices and services, including any device requesting 
access to network resources and services. 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(10) Ensure that for any device to access and 
communicate with critical infrastructure devices and 
services within the domain, the authentication traffic 
has to be signed and encrypted. 
(11) Limit the administrator account from ac-
cessing critical infrastructure devices and services, 
including domain controllers, throughout the net-
work and use such account only for emergencies. 
(12) Restrict remote access to local adminis-
trator accounts and use firewall rules to restrict lat-
eral movement on the network. 
(13) Employ enterprise-wide content centric se-
curity or digital rights management to encrypt, ana-
lyze and monitor sensitive documents and informa-
tion after it leaves a content management system. 
(c) ADDITIONAL ACTIONS REQUIRED.—In carrying 
out subsection (a), the Secretary shall carry out the fol-
lowing actions to detect a network intrusion: 
(1) Demonstrate the applicability of the NIST 
Risk Management Framework in the selection, im-
plementation, assessment, and ongoing monitoring of 
privacy controls deployed in Federal information sys-
tems, programs, and organizations. 
(2) Ensure that Network and Host based intru-
sion detection systems (NIDS/HIDS) are deployed 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
and properly configured on high-risk systems and 
areas of the network. 
(3) Ensure that proper auditing and event log-
ging are configured into servers, user systems, fire-
walls, networking devices, applications, and domain 
controllers. 
(4) Ensure that audit and event logs are for-
warded and collected in a central repository for stor-
age and analysis. 
(5) Conduct regular audits and testing of the 
backups and restore events of the critical infrastruc-
ture devices and services. 
(6) Conduct regular formal penetration testing 
to test for potential security weaknesses and resolve 
such weaknesses by not later than seven days after 
identifying such weaknesses. 
(7) Deploy proper log review capabilities includ-
ing automated and manual methods such as via a 
Security Information and Event Monitoring (SIEM) 
solution able to detect, at a minimum— 
(A) events tied to known signatures such 
as common malware and exploits; 
(B) network traffic attempting to access 
known malicious IP addresses, URLs, or do-
mains; 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(C) changes in network traffic behavior 
such as unexpected traffic over abnormal ports; 
(D) application level events such as at-
tempted injection attacks; 
(E) abnormal use of user, application, and 
privileged accounts; and 
(F) attempted or successful movement of 
sensitive data in any unapproved, unencrypted 
manner. 
(d) ADDITIONAL ACTIONS REQUIRED.—If a network 
intrusion is detected, in carrying out subsection (a), the 
Secretary shall carry out the following responsive actions: 
(1) Ensure that events identified through the 
security monitoring process are properly investigated 
and resolved through a defined Incident Response 
process staffed by trained responders supplemented 
by external industry experts retained as necessary 
with capabilities such as— 
(A) analysis of events generated by moni-
toring solutions; 
(B) pre-planned responses to common at-
tack types such as defacement, denial of serv-
ice, malware outbreaks, and Advanced Per-
sistent Threat (APT) level threats; 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS