Why does the tone have to be ragebait? This is just a basic overview of what compliance looks like.
Presumably the prompt focused on the aspect described in the title, and the LLM obliged.
FIPS 140-3 is not a security guarantee, and auditors know it
11–20 of 30 posts
Re: FIPS 140-3 is not a security guarantee, and auditors know it
#12Perhaps never a true guarantee, but level 4 HSMs are still impressive.
> The 4769 HSM has been verified to meet the FIPS 140-2 Level 4 requirements by protecting against attacks that include penetration of the secure module, side-channel attacks, and environmental failure protection (power or temperature manipulation). From the time of manufacture, the hardware is fully self-protecting. If tamper sensors detect a possible attack, all critical keys and other sensitive data are immediately destroyed and the HSM is rendered permanently inoperable. Note therefore that the 4769 HSM must be maintained at all times within the temperature, humidity, and barometric pressure ranges specified.
https://public.dhe.ibm.com/security/cryptocards/pciecc4/docs...
Re: FIPS 140-3 is not a security guarantee, and auditors know it
#13Government crypto governance seems to be written by people who think aerospace engineering is the epitome of diligence.
My friends in Christ, a aerodynamic object need only contend with 7 degrees of freedom, and occasional take-offs and landings.
Re: FIPS 140-3 is not a security guarantee, and auditors know it
#14Huh, I don't know about the world of HSMs or crypto and their audits, but in FedRAMP SaaS, you absolutely have to run everything with FIPS mode enabled, there are strong guarantees that need to be in place and audited.
I don't know about FedRAMP specifically, but I have gone through several procurements for federal agencies on the vendor side, and have never had any issues getting a FIPS waiver approved.
Re: FIPS 140-3 is not a security guarantee, and auditors know it
#15The practical benefit of FIPS 140 is less that your crypto is better and more that your systems will fail to establish connections with anything not using FIPS mode, thus reducing your threat exposure. A silver lining to the overall unfortunate situation that is the FIPS CMVP.
Re: FIPS 140-3 is not a security guarantee, and auditors know it
#16Perhaps never a true guarantee, but level 4 HSMs are still impressive. > The 4769 HSM has been verified to meet the FIPS 140-2 Level 4 requirements by protecting against attacks that include penetration of the secure module, side-channel attacks, and environmental failure protection (power or temperature manipulation). From the time of manufacture, the hardware is fully self-protecting. If tamper sensors detect a pos…
Reminds me of a Thales rack mount HSM the former security architect of CVS Caremark told me they deployed back in the 2000s. There were two of them in a dataceter used for a their transaction processing. One day, someone accidentally bumped into the rack where both HSMs were mounted, and they physically self-destructed, causing a major incident.
Re: FIPS 140-3 is not a security guarantee, and auditors know it
#17Huh, I don't know about the world of HSMs or crypto and their audits, but in FedRAMP SaaS, you absolutely have to run everything with FIPS mode enabled, there are strong guarantees that need to be in place and audited.
In reality FedRAMP has multiple variations, low, moderate, high, gives enough wiggle room to companies on what they can do when. Other good thing about government is that its quite flexible when needed. There is always exists a path to override a regulation if required.
Re: FIPS 140-3 is not a security guarantee, and auditors know it
#18> Track the lifecycle, not the purchase.
In my experience this is the core issue with security. It has to be a continuous process in reality but its hard to justify the cost and resource allocation. For this reason it ends up being a point in time function leaving gaps over the life cycle of the product.
Re: FIPS 140-3 is not a security guarantee, and auditors know it
#19The practical benefit of FIPS 140 is less that your crypto is better and more that your systems will fail to establish connections with anything not using FIPS mode, thus reducing your threat exposure. A silver lining to the overall unfortunate situation that is the FIPS CMVP.
There’s no automatic enforcement across most systems though. You can use a Thales HSM that’s configured in FIPS mode just fine from non-FIPS software.
Re: FIPS 140-3 is not a security guarantee, and auditors know it
#20Perhaps never a true guarantee, but level 4 HSMs are still impressive. > The 4769 HSM has been verified to meet the FIPS 140-2 Level 4 requirements by protecting against attacks that include penetration of the secure module, side-channel attacks, and environmental failure protection (power or temperature manipulation). From the time of manufacture, the hardware is fully self-protecting. If tamper sensors detect a pos…
Reminds me of a Thales rack mount HSM the former security architect of CVS Caremark told me they deployed back in the 2000s. There were two of them in a dataceter used for a their transaction processing. One day, someone accidentally bumped into the rack where both HSMs were mounted, and they physically self-destructed, causing a major incident.
One hopes that there were recovery keys or equivalent in a fireproof safe offsite somewhere.