3 ms·

Huh, I don't know about the world of HSMs or crypto and their audits, but in FedRAMP SaaS, you absolutely have to run everything with FIPS mode enabled, there a

by afarah1 2mo ago

Huh, I don't know about the world of HSMs or crypto and their audits, but in FedRAMP SaaS, you absolutely have to run everything with FIPS mode enabled, there are strong guarantees that need to be in place and audited.

bb88 2mo ago
If the requirement causes a massive security hole, the lawyers will probably tell you that knowingly allowing a security hole from a liability perspective is worse than turning off something an audit will flag.
sublinear 2mo ago
> That lag creates a perverse choice every vendor of validated modules eventually faces: ship the security fix now and fall off the validated list for a year or more, or keep shipping the validated build with the known flaw. Customers whose contracts require an active certificate are, in effect, paying the vendor to choose the second option. That's what the blog post says about why/when FIPS is turned off, although I'm not sure I completely agree with this take. All forms of compliance in all industries (not just IT) is like this. Otherwise we get a lot of cowboy solutions. This is why compliance does not operate in a silo. There's the baseline (when FIPS is on) and then there's the real world configuration that the business must carefully accept along with its own risks. This is why you have your own employees auditing and collaborating with everyone else involved in the decisions. That can often include the client wanting your services that depend on the HSMs. I'm not understanding what all the frustration is about unless some people have just never left their silo. If your client is the government, then of course they're going to be very strict about FIPS. We're all at least in agreement that FIPS sucks because it moves at a glacial pace. There's a reason the phrase: "good enough for government work" means mediocre.
dlgeek 2mo ago
FedRAMP actually has a bunch of workarounds for the problems of FIPS. In the "FedRAMP Policy for Cryptographic Module Selection and Use" (https://www.fedramp.gov/resources/documents/FedRAMP_Policy_for_Cryptographic_Module_Selection_v1.1.0.pdf https://www.fedramp.gov/resources/documents/FedRAMP_Policy_f...), there are a ton of gems that make it clear that the FedRAMP folks are fed up with the CMVP process backlog. The most explicit is: "FRR9: CSPs shall determine if updating to a newer version of the software, whether or not its cryptographic modules are FIPS validated, would eliminate the vulnerabilities; if it would, CSPs shall promptly update if that is feasible."
- tw04 2mo ago
  How is that “a problem with FIPS?” In layman’s terms that basically says if there’s a 0-day, patch first and we’ll worry about validation later. You could say that’s “an issue” with literally every software package that has a support contract on earth. I can’t count how many times in my career we had to apply a patch release that wasn’t “officially ga” because of a zero day. That’s common sense, not a FIPS issue.
  - rileymat2 2mo ago
    If our need to update fips certified packages out paces the ability to certify packages, that is absolutely a problem with the design of FIPs certifications.
    - beardedwizard 2mo ago
      +1, been all the way to fed ramp high and this is a huge part of the security theater that is fedramp. The second best part is either getting really good at patching every single thing, or playing the POA&M game.
    - pseudohadamard 2mo ago
      So your choice inevitably boils down to running some ancient vulnerability-riddled version that's FIPS certified or running a recent less vulnerability-riddled version that's not certified. Most orgs that I've worked with keep running the vulnerable version because they have to be able to check the box that says "FIPS certified".
gizmo686 2mo ago
I don't know about FedRAMP specifically, but I have gone through several procurements for federal agencies on the vendor side, and have never had any issues getting a FIPS waiver approved.
sandeepkd 2mo ago
In reality FedRAMP has multiple variations, low, moderate, high, gives enough wiggle room to companies on what they can do when. Other good thing about government is that its quite flexible when needed. There is always exists a path to override a regulation if required.
hamburglar 2mo ago
Even on fedramp high, it’s possible to just be mistaken about configurations and still pass. I have been in the situation where I’m the guy answering all sorts of questions to the best of my ability to get the certification, then later discovered some of the claims made by developers were just not true and we had been out of compliance on a fedramp high datacenter for months. On accident.

by afarah1 2mo ago

bb88 2mo ago

If the requirement causes a massive security hole, the lawyers will probably tell you that knowingly allowing a security hole from a liability perspective is worse than turning off something an audit will flag.

sublinear 2mo ago

> That lag creates a perverse choice every vendor of validated modules eventually faces: ship the security fix now and fall off the validated list for a year or more, or keep shipping the validated build with the known flaw. Customers whose contracts require an active certificate are, in effect, paying the vendor to choose the second option. That's what the blog post says about why/when FIPS is turned off, although I'm not sure I completely agree with this take. All forms of compliance in all industries (not just IT) is like this. Otherwise we get a lot of cowboy solutions. This is why compliance does not operate in a silo. There's the baseline (when FIPS is on) and then there's the real world configuration that the business must carefully accept along with its own risks. This is why you have your own employees auditing and collaborating with everyone else involved in the decisions. That can often include the client wanting your services that depend on the HSMs. I'm not understanding what all the frustration is about unless some people have just never left their silo. If your client is the government, then of course they're going to be very strict about FIPS. We're all at least in agreement that FIPS sucks because it moves at a glacial pace. There's a reason the phrase: "good enough for government work" means mediocre.

dlgeek 2mo ago

FedRAMP actually has a bunch of workarounds for the problems of FIPS. In the "FedRAMP Policy for Cryptographic Module Selection and Use" (https://www.fedramp.gov/resources/documents/FedRAMP_Policy_for_Cryptographic_Module_Selection_v1.1.0.pdf https://www.fedramp.gov/resources/documents/FedRAMP_Policy_f...), there are a ton of gems that make it clear that the FedRAMP folks are fed up with the CMVP process backlog. The most explicit is: "FRR9: CSPs shall determine if updating to a newer version of the software, whether or not its cryptographic modules are FIPS validated, would eliminate the vulnerabilities; if it would, CSPs shall promptly update if that is feasible."

tw04 2mo ago
How is that “a problem with FIPS?” In layman’s terms that basically says if there’s a 0-day, patch first and we’ll worry about validation later. You could say that’s “an issue” with literally every software package that has a support contract on earth. I can’t count how many times in my career we had to apply a patch release that wasn’t “officially ga” because of a zero day. That’s common sense, not a FIPS issue.
- rileymat2 2mo ago
  If our need to update fips certified packages out paces the ability to certify packages, that is absolutely a problem with the design of FIPs certifications.
  - beardedwizard 2mo ago
    +1, been all the way to fed ramp high and this is a huge part of the security theater that is fedramp. The second best part is either getting really good at patching every single thing, or playing the POA&M game.
  - pseudohadamard 2mo ago
    So your choice inevitably boils down to running some ancient vulnerability-riddled version that's FIPS certified or running a recent less vulnerability-riddled version that's not certified. Most orgs that I've worked with keep running the vulnerable version because they have to be able to check the box that says "FIPS certified".

gizmo686 2mo ago

I don't know about FedRAMP specifically, but I have gone through several procurements for federal agencies on the vendor side, and have never had any issues getting a FIPS waiver approved.

sandeepkd 2mo ago

In reality FedRAMP has multiple variations, low, moderate, high, gives enough wiggle room to companies on what they can do when. Other good thing about government is that its quite flexible when needed. There is always exists a path to override a regulation if required.

hamburglar 2mo ago

Even on fedramp high, it’s possible to just be mistaken about configurations and still pass. I have been in the situation where I’m the guy answering all sorts of questions to the best of my ability to get the certification, then later discovered some of the claims made by developers were just not true and we had been out of compliance on a fedramp high datacenter for months. On accident.