FIPS 140 Consulting

FIPS 140 Consulting Services

Specific services for FIPS 140 include the following:

Product design assistance
Design your product for compliance. Retrofit your product to meet FIPS 140 requirements. Our engineers provide design consulting and source code review to help prepare your product for validation.

Education and training
Our highly acclaimed workshops educate your staff on FIPS 140 process, requirements, timelines, and best practices. Whether you’re kicking off a FIPS validation project or planning for a future release, our Strategic Planning Sessions will answer your questions and help you plan for success.

Project management for entire validation process
Our resources have program backgrounds in Fortune 500 companies and government offices. We know how to run a project to be successful, and we do it from a vendor’s perspective.

FIPS 140 documentation  development

• The Security Policy is a non-proprietary document that summarizes the features of the module under test, how the module meets the FIPS 140-2 requirements, and how to operate the module in a FIPS 140-approved mode of operation.
• The Finite State Machine is a proprietary document that details the discrete, high-level states of the module and the inputs and outputs for the respective state transitions.
• The Vendor Evidence document provides a proprietary discussion of how a module meets all applicable requirements of FIPS 140.
• The User & Crypto Officer Guidance provides specific instructions for secure operation and administration of the cryptographic module.

Testing and validation support
Apex Assurance Group provides the following services to support testing and validation:

• Revise FIPS 140-2 documentation to address verdicts from the testing laboratory and from NIST CMVP
• Provide project management support to answer questions and quickly resolve/escalate issues
• Act as a first line of defense for questions and issues that come from the testing laboratory
• Facilitate algorithm testing
• Liaison any necessary code reviews
• Support questions, comments, and documentation changes requested by NIST CMVP during their validation process.

Apex Assurance Group will provide consulting support to facilitate testing of cryptographic algorithms for the cryptographic module under test. As part of a FIPS 140-2 validation, a vendor must have each FIPS-approved algorithm validated to ensure conformance to its respective standard. Each approved algorithm has an associated validation suite, which specifies data formats required to verify the implementation. Algorithm testing is a set of rigorous black-box tests run on the implementation to ensure conformance to the respective validation suite.

Glossary of Terms

Accreditation
FIPS 140 labs are accredited by national government agencies to conduct FIPS 140 validations.  Accreditation involves meeting quality process standards and demonstrated expertise in FIPS 140 validation.

Architecture
Module architecture refers to the high-level structure and design of the product including its major modules and interfaces.  The Architecture may also include specific technologies used in the module.

Assurance
Assurance is confidence that the module or product will operate securely and as specified in the FIPS 140 standards.  Assurance is gained by independent, third-party evaluation against internationally-recognized security standards.

Best Practices
Practices become known as Best Practices when they have proven to be particularly effective.  Best Practices have been demonstrated to be effective in a number of circumstances and environments.

Buy Versus Build
Buy versus Build decisions are made to determine whether it is better to purchase outsourced services or products over using in-house resources to perform the service or deliver the product.  The Buy-versus-Build analysis requires consideration of several factors including costs and benefits.

Certification
Certification (or validation) marks the final, official completion of a successful FIPS 140 validation. Technically, products are validated to meet the FIPS 140 standard. They receive a certificate of validation, which is posted on the CMVP Website.

Configuration
Configuration refers to the settings or customization of products for use in customer environments.  These configuration settings adjust for the unique deployment environment.  Inappropriate security settings may result in exploitable vulnerabilities.

Configuration Management
Product configuration management (CM) controls and organizes the components of the product to ensure that all of the correct component versions are used to build the product.  For software products, configuration management is usually managed by source code control tools such as CVS or Perforce.

Ciphertext
Ciphertext or encrypted text is the result of encrypting plaintext using a cryptographic algorithm.

Critical Security Parameter
Critical security parameters are security-related information such as secret and private cryptographic keys, and authentication data such as passwords.  The disclosure or modification of critical security parameters can compromise the security of a cryptographic module.

Cryptographic Boundary
The cryptographic boundary is the well-defined perimeter that established the physical bounds of a cryptographic module and contains all the hardware, software, and/or firmware components of a cryptographic module.

Cryptography
Cryptography (or cryptology) is defined as the practice and study of hiding information.

Defense in Depth
Defense in depth is the concept of employing several layers of information security measures to protect information assets.

Encryption
Encryption (or encoding) is the process of transforming information into a form that is understandable only to those for which the information is intended.

Cryptographic or Encryption Technology
Cryptographic or encryption technology is the embodiment of the encryption process as in the form of hardware or software.

Cryptographic Module
Cryptographic module is a product or part of a product that encapsulates some cryptographic technology.

Due Diligence
Due diligence is the practice of carefully examining alternatives before committing to purchase.  Vendors will practice due diligence prior to selecting evaluation labs or consultants.  This examination will include assessments across a variety of categories including: price, technical expertise, demonstrated experience and quality.

Environmental Failure Protection
Environmental failure protection is the use of features to protect against a compromise of the security of a cryptographic module due to environmental conditions or fluctuations such as heat outside of the module’s normal operating range.

Environmental Failure Test
Environmental failure test is the use of testing to provide assurance that the security of a cryptographic module will not be compromised by environmental conditions or fluctuations outside of the module’s normal operating range.

Error Detection Code
Error detection code is a code computed from data and comprised of redundant bits of information designed to detect unintentional changes in the data.

Evaluation
Evaluation is the examination of evidence by independent, accredited third-party testing laboratories.  Independent examination against international standards is the foundation for the Common Criteria (CC).  Security assurance is derived through evaluation.

Federal Information Processing Standard 140
Federal Information Processing Standard 140 (FIPS 140) is the standard maintained by the U.S. National Institute of Standards and Technology (NIST) and the Canadian Communications Security Establishment (CSE) pertaining to cryptographic module standards.

Finite State Model
A finite state model is a mathematical model of a system that is comprised of a finite set of input events, output events, and states.  The FSM also maps states and input to output, state transitions, and describes the initial state.

Fixed-Price
Fixed price contracts are financial agreements between service providers and clients whereby the client agrees to pay a firm, fixed price for services and deliverables provided by the vendor.

Implementation Under Test
The implementation under test is the term used by NIST and FIPS 140 testing labs to designate the cryptographic module submitted to FIPS 140 validation testing.

Information Technology
Information Technology (IT) is the general term used for computers, electronic data storage, networking, operating systems, databases, application software and other technologies used to process, transmit, and store electronic information.

Intellectual Property
Intellectual Property (IP) is the knowledge or technology owned by an organization.  IP generally has some competitive value and must be protected in order to maintain a competitive advantage in the marketplace.

Key Establishment
Key establishment is the process by which cryptographic keys are securely distributed among cryptographic modules using a combination of manual and/or automated transport methods.

Key Generation
Key generation is the act of creating cryptographic keys.  These keys are used to encrypt plaintext to ciphertext and to decrypt ciphertext to plaintext.

Key Management
Key management are the activities involving the handling of cryptographic keys and other related security parameters during the entire life cycle of the keys, including their generation, storage, establishment, entry and output, and zeroization.

Known Answer Test
Known answer tests are functional tests of cryptographic algorithms to check for the proper operation of the cryptographic functions using previously generated results from selected inputs.

Module
The set of software, hardware, or combination of both that is subject to validation.

Non-repudiation
Non-repudiation is the concept that the integrity and origin of data can be proven with authentication.

Personally Identifiable Information
Personally identifiable information is information that is used to uniquely identify an individual.  This information is commonly used for authentication purpose.

Plaintext
Plaintext is human-readable and natural language text. 

Platforms
Platforms refer to the computing base upon which application software will execute.  The Platform may be viewed as the dependencies of the application software including: operating system, computer hardware and networking.

Private Key
A private key is a cryptographic key, used in conjunction with a public key cryptographic algorithm that is uniquely associated with an entity and is not made public.

Public Key
A public key is a cryptographic key used with a public key cryptographic algorithm that is uniquely associated with an entity and that may be made public.

Quality Assurance
Quality Assurance (QA) is a function within the developer organization chartered with the responsibility for establishing and executing product quality practices.  The QA team is usually responsible for developing and executing product tests.

Secure Development
Secure Development is the set of practices believed to result in a more secure product.  These practices may include: security training, use of security tools, security testing and use of secure coding practices.

Security Policy
The cryptographic module security policy is a precise specification of the security rules under which a cryptographic module will operate, including the rules derived from the requirements of the FIPS 140 standard and additional rules imposed by the vendor.

Split Knowledge
Split knowledge is the process by which a cryptographic key is split into multiple components.  Individually each component is insufficient to encrypt or decrypt data, but can be re-assembled to recreate the original cryptographic key.

Tamper Detection
Tamper detection is the automatic determination by a cryptographic module that an attempt has been made to compromise the physical security of the module.

Tamper Evidence
Tamper evidence is the external indication that an attempt has been made to compromise the physical security of a cryptographic module.

Tamper Response
Tamper response is the automatic action taken by a cryptographic module when tamper detection has occurred.

Time and Materials
Time and Materials (T&M) contracts are set up whereby the provider is paid based on the time and materials actually spend on a project.  The customer only pays for what has been used.  Fixed price contracts are an alternative.

Time-to-Market
Time-to-Market (TTM) is the concept that products that are introduced into the marketplace ahead of the competition enjoy a revenue generation advantage.  TTM drives product vendors to try to be first on the market with a new product or new capability.

Validation
Validation is the process xof testing and verifying that a cryptographic module meets the security requirements claimed in the cryptographic security policy.

Version
A version is a uniquely identifiable variation or revision of a product.  FIPS 140 validations are valid only for a specified version of a product.  That version is specified in the Security Policy document.

Vulnerabilities
Vulnerabilities are security flaws or weaknesses that may be accidentally or maliciously exploited to expose unauthorized access to data or systems.

Zeroization
Zeroization is a method of erasing electronically stored data, cryptographic keys, and CSPs by altering or deleting the contents of the data storage to prevent recovery of the data.