Verizon Wireless just made it more expensive to cancel your contract
Storage for spies: How the FIPS standard makes data extremely hard to steal
Keep it secret, keep it safe. When you want your digital storage to be encrypted, tamper-proof, and very hard to steal, you want the drive to have FIPS certification. The FIPS label means it complies with the Federal Information Processing Standards that delineate everything concerning government data security.
FIPS covers everything from access to buildings to personnel IDs, but we’re going to focus on its application to digital storage—more specifically, the security standards that storage manufacturers must adhere to in order to sell their products to the U.S. government. FIPS is relevant to the corporate market, where data security is a major issue. FIPS certification also appeals to a certain segment of the consumer market. Why? Because spy stuff sells.
Narrow a FIPS discussion to data storage and you’re talking mostly about FIPS 140 (the current version of which is 140-2, with 140-3 in the works). FIPS 140 lays down the guidelines and requirements for the physical security of cryptographic modules, such as those used in secure flash and mechanical hard drives. It’s split into four levels to address security scenarios from the mild to the extreme. Some storage devices merely claim to meet FIPS 140 standards.
To avoid buying a product whose manufacturer has simply co-opted the name for marketing purposes, look for the phrase “FIPS 140-2 Level N Certified” that indicates that the product has undergone the rigorous and somewhat expensive certification process at an accredited testing lab.
Security Strata
FIPS 140-2 Level 1 specifies that a storage unit’s cryptographic module can’t be absurdly easy to access. That is, it can’t be sitting on top of the device with an arrow pointing to it, or hidden beneath a panel that’s secured by a single screw.
FIPS 140-2 Level 2 adds another layer of security: It specifies that role-based authentication be added to the access mix. There must be an administrator (a “crypto officer” in FIPS parlance) who is allowed full access to the configuration functions of the cryptographic module, restricted users who can use the device only for storage, and then maintenance access for IT admins who might be allowed only to format the drive.
Devices certified for this level must also provide a means for making it abundantly apparent that someone has physically tampered with a secure device’s cryptographic module. By its very design, the device must show evidence that someone was mucking about with it. That could be by means of a cracked case, stripped fasteners, bent hinges, or what have you.
Most vendors shoot for Level 3 when FIPS-certifying their storage devices. This level of security requires measures to prevent any tampering with the device’s cryptographic module, and rendering it inoperable if it’s breached (thus making it impossible for anyone to access the data stored on the device). This can be accomplished by encasing the crypto module in epoxy, a welded metal case with intrusion detection, or something similar. Achieving Level-3 certification is generally enough to qualify a product for sale to most government agencies, and it easily meets the needs of the average consumer or corporation.
Level 4 adds the ability to withstand environmental attacks, such as in high temperatures and voltages that might be used in an attempt to compromise the crypto module. It’s not meant to protect the device from monsoons or tornadoes. Staring down heat and high voltage is tough work, and achieving that level of protection adds a great deal of cost. FIPS 140-2 Level 4 is extreme overkill for consumers and even most businesses.
Encryption
The FIPS standards we’ve covered so far apply to the protection of the device’s cryptographic module. FIPS 197 describes the actual means of encryption. You don’t hear much about FIPS 197 because it morphed into the Advanced Encryption Standard (AES). AES-128, AES-192, and AES-256. The numbers identify the length of the encryption key in bits: The longer the key, the stronger the encryption.
If you see AES listed as an encryption method on the storage device you’re considering, you’re looking at a FIPS 197 product. A host of other encryption algorithms are available, and with the NSA known to have supported many open source security projects (SSL, PGP, etc.) it’s conceivable that a FIPS 197 device might be your better option. Just sayin’.
Do you need FIPS-certified storage?
As I mentioned earlier, most vendors get FIPS 140 certification so they can sell their products to the government. Unless you’re protecting extremely sensitive information that a sophisticated criminal would go to great lengths to obtain, you’ll be well served by a plain ol’ hard drive and one of the free and readily available encryption programs such as… well, I was going to say TrueCrypt, but controversy has swirled around the limited version released by its developers before shutting down the project. That said, by all reports the 71 a old version work as well as they ever did.
Tempests in teapots aside, Microsoft’s BitLocker drive encryption (included with the Pro and Ultimate versions of Windows 7, and the Pro and Enterprise versions of Windows 8) will do the trick, and most non-FIPS-certified drives come with viable encryption software. Though pricey, Best cypt is the real deal, and the choice of many governments.
But if you must have (or simply want) something that’s relatively hassle-free and basically un-hackable in the real world, go with FIPS 140-2 Level 3-certified hardware.
Comments
Post a Comment