Laserfiche WebLink
WSPContractNo.CRDOO160WSPrecognizesthattheFBICJISSecurityPolicyisaminimumstandardandthatcircumstancesareencounteredthatcreateaneedforadditionalsecuritymeasures.ThesestandardsareinadditiontothecurrentCJISSecurityPolicy.a.Livescandeviceswillcomplywiththefollowingsecurityrequirements:i.UnauthorizedunescortedphysicalandlogicalaccesstoLivescandeviceswillberestricted.Insomeenvironments,itmightnotberealistictoexpectabsolutecontroloveraLivescandevice100%ofthetime.Intheseenvironments,acceptableriskmitigationswillbeprovidedinlieuof100%controlthroughescortedaccess.TheWSPreservestherighttoobjecttoequipmentsecuritymeasuresandtosuspendorwithholdserviceuntilsuchmattersarecorrectedtothereasonablesatisfactionofWSP.ii.Livescandeviceswillbesinglepurposeworkstations.Thatis,applicationsusedontheworkstationwillbeusedonlyforfunctionsinvolvingLivescans.iii.WhenCJlistransmittedoutsidetheboundaryofthephysicallysecurelocation,thedatashallbeimmediatelyprotectedviaencryption.Whenencryptionisemployed,thecryptographicmoduleusedshallbeFIPS140-2certifiedanduseasymmetriccipherkeystrengthofatleast128bitstrengthtoprotectCJI.iv.Livescandeviceswillhaverestrictedinternetaccess(i.e.authorizedvendorsupport).v.Livescandeviceswillnothostemailclientsthatcanreceiveemailfromtheinternet.vi.LivescandeviceswillnotbeusedtodisplayoreditdocumentsexceptforreportsproducedbytheLivescandevice(wordprocessing,spreadsheets,PDF's,etc.),vii.Livescandeviceswillnotbeconnectedtoanyexternalmedia,exceptforthepurposeofperformingsoftwareandapplicationupgrades.ThemediashouldbeusedonlyonLivescandevices,Ifthemediaisusedonanon-Livescandevice,itwillbeerasedandanewimagewillbeplacedonthemediabeforeitisusedwithaLivescandevice.viii.LivescandeviceswillbeprotectedfromworkstationsthatdohavegeneralworkstationfunctionsbyfirewallsthatprohibitexternalaccesstoLivescandevices,ix.TheLivescanwillbelocatedinanareathatisphysicallyrestrictedtothepublicorotherunauthorizedusers.WhentheLivescanisnotinuseandleftunattended,itmustbeloggedoffandpasswordprotected.InthecasesofportableLivescans,theLivescanwillnotbeleftunattendedinanon-securearea.b.AllsecurityexceptionsmustbedocumentedinwritingandapprovedbyWSPandWIN.c.Thethreatvectorscurrentlyaddressedare:i.Physicalaccessissuesii.Multiplelsharedfunction(duetosecurityissuesraisedbyco-residentapplications)iii.UnrestrictedinternetaccessApprovedastoFormbytheWashingtonAttorneyGeneral2018LivescantoWINABISUserAgreement05/08/2018Page2of7