BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1 INTRODUCTION (was: OVERVIEW)

NIST platform security: roots of trust, firmware and secure enclaves FIPS 140-3 against FIPS 140-2
All changes in this version
modified 1 INTRODUCTION

Title changed

Before · FIPS 140-2

OVERVIEW

After · FIPS 140-3

OVERVIEWINTRODUCTION

Control changed

Before · FIPS 140-2

This standard specifies the security requirements for a cryptographic module utilized within a security system protecting sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106.

FIPS 140-1 was developed by a government and industry working group composed of both operators and vendors. The working group identified requirements for four security levels for cryptographic modules to provide for a wide spectrum of data sensitivity (e.g., low value administrative data, million dollar funds transfers, and life protecting data) and a diversity of application environments (e.g., a guarded facility, an office, and a completely unprotected location). Four security levels are specified for each of 11 requirement areas. Each security level offers an increase in security over the preceding level. These four increasing levels of security allow cost-effective solutions that are appropriate for different degrees of data sensitivity and different application environments. FIPS 140-2 incorporates changes in applicable standards and technology since the development of FIPS 140-1 as well as changes that are based on comments received from the vendor, laboratory, and user communities.

While the security requirements specified in this standard are intended to maintain the security provided by a cryptographic module, conformance to this standard is not sufficient to ensure that a particular module is secure. The operator of a cryptographic module is responsible for ensuring that the security provided by the module is sufficient and acceptable to the owner of the information that is being protected, and that any residual risk is acknowledged and accepted.

Similarly, the use of a validated cryptographic module in a computer or telecommunications system is not sufficient to ensure the security of the overall system. The overall security level of a cryptographic module must be chosen to provide a level of security appropriate for the security requirements of the application and environment in which the module is to be utilized and for the security services that the module is to provide. The responsible authority in each organization should ensure that their computer and telecommunication systems that utilize cryptographic modules provide an acceptable level of security for the given application and environment.

The importance of security awareness and of making information security a management priority should be communicated to all users. Since information security requirements vary for different applications, organizations should identify their information resources and determine the sensitivity to and the potential impact of losses. Controls should be based on the potential risks and should be selected from available controls, including administrative policies and procedures, physical and environmental controls, information and data controls, software development and acquisition controls, and backup and contingency planning.

The following sections provide an overview of the four security levels. Common examples, given to illustrate how the requirements might be met, are not intended to be restrictive or exhaustive.

The location of Annexes A, B, C, and D can be found in APPENDIX D: SELECTED BIBLIOGRAPHY.

After · FIPS 140-3

This standard specifies the security requirements for a cryptographic module utilized within a security system protecting sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, (Public Law 104-106) and the Federal Information Security Management Act of 2002 (Public Law 107-347).

FIPS 140-1, first published in 1994, was developed by a government and industry working group composed of both operators and vendors. The working group identified requirements for four security levels for cryptographic modules to provide for a wide spectrum of data sensitivity (e.g., low value administrative data, million dollar funds transfers, and life protecting data) and a diversity of application environments (e.g., a guarded facility, an office, and a completely unprotected location). Four security levels arewere specified for each of 11eleven requirement areas. Each security level offersoffered an increase in security over the preceding level. These four increasing levels of security allowallowed cost-effective solutions that arewere appropriate for different degrees of data sensitivity and different application environments.

In 2001, FIPS 140-2 incorporatessuperseded FIPS 140-1. FIPS 140-2 incorporated changes in applicable standards and technology since the development of FIPS 140-1 as well as changes that arewere based on comments received from the vendor, laboratory, and user communities.

While the security requirements specified in this standard are intended to maintainThough the securitystandard providedwas byreviewed aafter cryptographic5 moduleyears, conformanceconsensus to thismove standardforward iswas not sufficient to ensure that a particular module is secure.achieved Theuntil operatorpublication of a cryptographic module is responsible for ensuring that the security provided by the module is sufficient and acceptable to the2012 ownerrevision of the information that is being protected, and thatInternational anyOrganization residualfor riskStandardization/International isElectrotechnical acknowledgedCommission and(ISO/IEC) accepted19790.

Similarly, the use of a validated cryptographic module in a computer or telecommunications system is not sufficient to ensure the security ofFIPS the140-3 overallsupersedes systemFIPS140-2. The overall security level of a cryptographic module must be chosen to provide aFIPS level140-3 ofaligns securitywith appropriateISO/IEC for19790:2012(E) theand securityincludes requirementsmodifications of the application and environment in whichAnnexes thethat moduleare isallowed to be utilized and for the security services that theCMVP module(as isa tovalidation provideauthority). The responsible authority in each organization should ensure that their computer and telecommunication systems that utilize cryptographic modules provide an acceptable level of securitytesting for the given application and environment.

The importance of security awareness and of making information security a managementthese priorityrequirements shouldwill be communicated to all users. Since information security requirementsin varyaccordance forwith differentISO/IEC applications24759:2017(E), organizations should identify their information resources and determine the sensitivity to and the potential impact of losses. Controls should be based onwith the potential risks and should be selected from available controlsmodifications, including administrative policies and procedures,additions physicalor anddeletions environmentalof controls,vendor informationevidence and data controls, software developmenttesting andallowed acquisitionas controls,a andvalidation backupauthority andunder contingencyparagraph planning5.

The following sections provide an overview of the four security levels2. Common examples, given to illustrate how theMajor requirementschanges mightin beFIPS met,140-3 are not intendedlimited to be restrictive or exhaustive.

Thethe locationintroduction of Annexes A, B, C, and D can be found in APPENDIX D:non-invasive SELECTEDphysical BIBLIOGRAPHYrequirements.