4

I feel more like a lawyer than an IT admin today.

When the CJIS Security Policy states that "The remote administrative personnel connection shall be via an encrypted (FIPS 140-2 certified) path," I'm left to wonder if that refers to Level 1, or if it's inclusive of the whole standard and all 4 levels?

It seems to be the former, since this NIST certificate gives no specific level, but in the listing here, I'm reading "Overall Level: 1" to mean that it's Level 1 certified.

That's a lot of assumption and supposition. I'm hoping this makes sense to people more solidly InfoSec grounded. If anyone can point me toward a clearer understanding of the correct interpretation of this, I would very much appreciate it.

Edit: My main confusion here is that the CJIS document doesn't specify a level. Should that be interpreted as requiring Level 1 or Level 4?

2
  • 3
    Welcome to the world of FIPS compliance where everybody squints at the vaguely worded rules and says "Don't know what that means, but eh, I could argue my way through an audit". Jun 22, 2016 at 16:02
  • 1
    I would interpret that as meaning any FIPS level as long as it is FIPS certified module providing the encryption.
    – Mr. Stone
    Jun 23, 2016 at 18:41

1 Answer 1

2

I'm a FIPS tester and confirm that indeed overall level 1 means it is validated at FIPS 140-2 level 1. Different sections can be tested and validated at different levels (1-4) however the overall level defaults to the section validated at the lowest level.

3
  • 1
    So to answer the OP's direct question, that means their remote administrative personnel connection would meet the policy as long as the solution uses modules with any kind of FIPS certification (Level 1 or above)? Jun 22, 2016 at 19:33
  • Yes, Mike's right. Sorry if my question isn't terribly clear - this is all pretty muzzy to me. Jun 22, 2016 at 19:51
  • Finally did get confirmation that the CJIS policy referenced intends that we meet Level 1 compliance only. Oct 3, 2016 at 18:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .