Source: www.upguard.com
What is FIPS 140-2? Cryptographic Module Validation Program | UpGuard
https://csrc.nist.gov/pubs/fips/140-2/upd2/final is a federal information processing standard that manages security requirements for cryptographic modules. This iteration introduced new critical security parameters for software and firmware and updated the four critical security levels that FIPS 140-2 introduced.
When the NIST introduced FIPS 140-1, it imposed requirements across eleven areas of cryptographic modules: Cryptographic module specification (documentation and procedural records) Ports and interfaces (what information flows in and out of a cryptographic module) User roles, access levels, and https://www.upguard.com/blog/mfa-multi-factor-authentication Finite state model (documentation of what states a module can occupy and when and why transitions are triggered) Physical security (tamper evidence and resistance) Operational environment (what operating system does a module use) Cryptographic key management (encryption generation, storage, lifecycle, and destruction) Electromagnetic compatibility (what systems is a module compatible with) Security tests (procedures outlining what tests must be completed and the consequences of failure) Module design (documentation that proves a module was designed to meet current industry standards) Attack mitigation (records proving a module has been designed to mitigate particular types of environmental attacks)
FIPS 140-3 also incorporates two existing standards (ISO 19790 and ISO 24759) to elevate its requirements for cryptographic modules and cryptographic algorithms.
Canada has also adopted FIPS standards to validate cryptographic modules throughout several highly regulated industries.
When the NIST introduced FIPS 140-1, it imposed requirements across eleven areas of cryptographic modules: Cryptographic module specification (documentation and procedural records) Ports and interfaces (what information flows in and out of a cryptographic module) User roles, access levels, and https://www.upguard.com/blog/mfa-multi-factor-authentication Finite state model (documentation of what states a module can occupy and when and why transitions are triggered) Physical security (tamper evidence and resistance) Operational environment (what operating system does a module use) Cryptographic key management (encryption generation, storage, lifecycle, and destruction) Electromagnetic compatibility (what systems is a module compatible with) Security tests (procedures outlining what tests must be completed and the consequences of failure) Module design (documentation that proves a module was designed to meet current industry standards) Attack mitigation (records proving a module has been designed to mitigate particular types of environmental attacks)
FIPS 140-3 also incorporates two existing standards (ISO 19790 and ISO 24759) to elevate its requirements for cryptographic modules and cryptographic algorithms.
Canada has also adopted FIPS standards to validate cryptographic modules throughout several highly regulated industries.
Related Articles
Community Partners
DevOps Careers