Corsec would like to congratulate the entire HPE Smart Array team on completing the FIPS 140-2 validation process. The completion of the certification process not only opens the doors to new and exciting markets for HPE, but also demonstrates their fervent commitment to product security.

To achieve this milestone, HPE partnered with Corsec, completing the validation at a Level 1 as seen in certificate #3397. For more information on the validation and to find additional details on the security policy, visit NIST’s validated modules site.

Their completion of the FIPS 140-2 validation process demonstrates their commitment to strong levels of security, including a government backed product offering and a dedication to providing customers and end users with the most scrutinized and highly tested security solutions.

For more information on engineering your product to meet Federal and regulated industry security requirements, schedule time to speak to a Corsec engineer.

About FIPS 140-2

FIPS 140-2 is a joint effort by the National Institute of Standards and Technology (NIST) in the United States, and the Communications Security Establishment Canada (CSEC), under the Canadian government. The Cryptographic Module Validation Program (CMVP), headed by NIST, provides module and algorithm testing for FIPS 140-2, which applies to Federal agencies using validated cryptographic modules to protect sensitive government data in computer and telecommunication systems. FIPS 140-2 provides stringent third-party assurance of security claims on any product containing cryptography that may be purchased by a government agency.

FIPS, which is mandated by law in the U.S. and very strictly enforced in Canada, is also currently being reviewed by ISO to become an international standard. FIPS 140-2 is gaining worldwide recognition as an important benchmark for third party validations of encryption products of all kinds. A FIPS 140-2 validation of a product provides end users with a high degree of product security, assurance, and dependability.

About Corsec Security, Inc.

For two decades Corsec has assisted companies through the IT security certification process for FIPS 140-2, Common Criteria (CC) and the DoD’s APL. We are a privately owned company focused on partnering with organizations worldwide to assist with the process of security certifications and validations. Our certification methodology helps open doors to new markets and increase revenue for clients with products ranging from mobile phones to satellites. Our broad knowledge safeguards against common pitfalls and thwarts delays, translating to a swift and seamless path to certification. Corsec has created the benchmark for providing business leaders with fast, flexible access to industry knowledge on security certifications and validations.

Stay up to date with Corsec as we bring you all the most recent updates to the standards, certifications, and requirements – Subscribe

###

Press Contact:

Corsec would like to congratulate our partner Virtual Instruments, a leader in hybrid infrastructure management that delivers solutions that help customers ensure their applications and infrastructure perform better together, on announcing that its VirtualWisdom Platform Appliance v5.7 has completed the Common Criteria certification process.

The VirtualWisdom Platform Appliance is a is an IPM appliance that holistically monitors, analyzes and optimizes the health, utilization, capacity and performance of IT infrastructure within the context of the application; the completion of the Common Criteria certification under the NIAP approved collaborative Protection Profile for Network Devices (NDcPP) gives governments and end users confidence that the VirtualWisdom Platform Appliance has passed strenuous documentation and testing requirements.

About Common Criteria

Common Criteria is an internationally recognized set of guidelines (ISO 15408), which define a common framework for evaluating security features and capabilities of Information Technology security products. The standard consists of several predetermined evaluation assurance levels, each one more stringent than the last. Common Criteria allows vendors to have their products tested against a chosen level by an independent third-party testing laboratory. The Common Criteria Mutual Recognition Agreement (CCRA) is a pact, which was designed to allow all evaluations up to an evaluation assurance level (EAL) 2, to be recognized by all participating countries, regardless of where the evaluation was completed. There are currently 28 countries involved in the CCRA, including the United States and Canada, with others that follow unofficially such as the EU.

The U.S. government mandates Common Criteria certification of security products for federal purchases. The National Information Assurance Acquisition Policy, NSTISSP No. 11, requires agencies to purchase only those commercial security products that have met specified third-party assurance requirements and have been tested by an accredited national laboratory.

About Virtual Instruments

Virtual Instruments is an exciting, high-growth Silicon Valley technology company.  Since their founding in 2008, they have been focused on delivering unparalleled value to our customers through a combination of innovative technology and high-value services. The VirtualWisdom platform provides comprehensive visibility into the performance, health and utilization of the IT infrastructure, empowering customers to guarantee the performance of their mission-critical applications across physical, virtual and cloud computing environments.

For further information, please visit virtualinstruments.com

2018 FEDERAL YEAR IN REVIEW

2018 was a stellar year for companies doing business with U.S. Federal Agencies. Over $95.6 billion dollars were allocated towards the procurement of secured IT products and solutions across Civilian, DoD, and the IC agencies.

Although Cold Boot Attacks are considered to be somewhat of an antiquated method, largely due to the need for an attacker to have physical access to the machine, they still represent a threat to unprotected systems.

By definition, a Cold Boot Attack is a type of side channel attack in which an attacker with physical access to a computer is able to retrieve encryption keys from a running operating system after using a cold reboot to restart the machine. Known since 2008, these attacks target data memory remanences, sometimes containing sensitive and personal information, on a CPU’s RAM which can linger anywhere from a few seconds to a few minutes after power has been removed. By utilizing a removable disk, attackers are able to upload sensitive data and viola, you have a security breach.

Many modern systems have security countermeasures to prevent these types of attacks; by memory scrambling or encrypting RAM the ability to steal encryption keys is essentially eliminated, but a new threat could threaten most modern computers according to experts.

Researchers from F-Secure, a Finnish company, have found new methods to disable current cold boot attack firmware security measures. This attack still requires the physical access that previous cold boot attacks utilized, but the threat is still present. The company is positioned to release additional information on their findings at upcoming events and conferences.

In the meantime, companies looking to protect their data can look to modernize security functionality of their systems by following guidelines and requirements laid out within FIPS 140-2. The FIPS requirements for level 3 require, in addition to all security measures from level 1 and 2, identity-based authentication, physical security mechanisms for tamper detection and tamper response, and zeroization of keys to destroy this type of data. Implementing these changes helps to prevent cold boot attacks from ever occurring.

For more information on engineering your product to meet Federal and regulated industry security requirements, schedule time to speak to a Corsec engineer.

About Corsec Security, Inc.

For two decades Corsec has assisted companies through the IT security certification process for FIPS 140-2, Common Criteria (CC) and the DoD’s APL. We are a privately owned company focused on partnering with organizations worldwide to assist with the process of security certifications and validations. Our certification methodology helps open doors to new markets and increase revenue for clients with products ranging from mobile phones to satellites. Our broad knowledge safeguards against common pitfalls and thwarts delays, translating to a swift and seamless path to certification. Corsec has created the benchmark for providing business leaders with fast, flexible access to industry knowledge on security certifications and validations.

Connect With Us

###

Press Contact:

Corsec would like to congratulate the entire HPE Smart Array team on completing the FIPS 140-2 validation process on the HPE Smart Array Gen9 P-Class RAID Controllers and HPE Gen9 Smart HBA H-Class Adapter.

Their completion of the FIPS 140-2 validation process demonstrates their commitment to strong levels of security, including a government backed product offering and a dedication to providing customers and end users with the most scrutinized and highly tested security solutions.

To achieve this milestone, HPE partnered with Corsec, completing the validation at a Level 1 as seen in certificate #3206. For more information on the validation and to find additional details on the security policy, visit NIST’s validated modules site.

For more information on engineering your product to meet Federal and regulated industry security requirements, schedule time to speak to a Corsec engineer.

About FIPS 140-2

FIPS 140-2 is a joint effort by the National Institute of Standards and Technology (NIST) in the United States, and the Communications Security Establishment Canada (CSEC), under the Canadian government. The Cryptographic Module Validation Program (CMVP), headed by NIST, provides module and algorithm testing for FIPS 140-2, which applies to Federal agencies using validated cryptographic modules to protect sensitive government data in computer and telecommunication systems. FIPS 140-2 provides stringent third-party assurance of security claims on any product containing cryptography that may be purchased by a government agency.

FIPS, which is mandated by law in the U.S. and very strictly enforced in Canada, is also currently being reviewed by ISO to become an international standard. FIPS 140-2 is gaining worldwide recognition as an important benchmark for third party validations of encryption products of all kinds. A FIPS 140-2 validation of a product provides end users with a high degree of product security, assurance, and dependability.

About Corsec Security, Inc.

For two decades Corsec has assisted companies through the IT security certification process for FIPS 140-2, Common Criteria (CC) and the DoD’s APL. We are a privately owned company focused on partnering with organizations worldwide to assist with the process of security certifications and validations. Our certification methodology helps open doors to new markets and increase revenue for clients with products ranging from mobile phones to satellites. Our broad knowledge safeguards against common pitfalls and thwarts delays, translating to a swift and seamless path to certification. Corsec has created the benchmark for providing business leaders with fast, flexible access to industry knowledge on security certifications and validations.

Stay up to date with Corsec as we bring you all the most recent updates to the standards, certifications, and requirements – Subscribe

###

The IoT expansion has been innovative, immersive, and impressive; revolutionizing modern day interactions and connectivity.

To meet this demand, companies are deploying products at rapid speed, while lowering prices to promote user adoption; leaving many in the security sector concerned about user data protection and proper product security hardening.

To address these concerns, The UK is taking a proactive approach, outlining a 13-point Code of Practice for manufactures, service providers, mobile application developers, and retailers to follow related to the IoT space – “Secure by Design: Improving the Cyber Security of Consumer Internet of Things Report”.

This concept may be new to the growing IoT space, but it is already the status quo for many products in Regulated Industries, as well as heavily mandated by Federal Governments around the globe. Their requirements for certifications like FIPS 140-2, Common Criteria, and the DoD’s APL address these concerns; ensuring products protect sensitive data and implement proper security architecture frameworks prior to deployment and network integration.

For companies looking to analyze their current security strategy and implement sound product security certification practices, there is help. Corsec Security is the global leader in providing assistance in security certifications and product security hardening. With the largest staff of experts in the industry and a comprehensive end-to-end solution that includes assessment audits, documentation, testing, enterprise lab services, and strategic product roadmap planning, Corsec has helped secure more than 400 unique products for hundreds of organizations on five continents over the last 20 years.

This guidance helps companies address security requirements for healthcare, financial services, critical infrastructure, national and international markets, and now IoT. Not only do they secure products, but also foster public trust and reap rewards for security investments, enabling you to overcome competitors in a market valued at over $3.5 trillion.

More on Product Security Hardening