I feel more like a lawyer than an IT admin today.

When the CJIS Security Policy states that "The remote administrative personnel connection shall be via an encrypted (FIPS 140-2 certified) path," I'm left to wonder if that refers to Level 1, or if it's inclusive of the whole standard and all 4 levels?

It seems to be the former, since this NIST certificate gives no specific level, but in the listing here, I'm reading "Overall Level: 1" to mean that it's Level 1 certified.

That's a lot of assumption and supposition. I'm hoping this makes sense to people more solidly InfoSec grounded. If anyone can point me toward a clearer understanding of the correct interpretation of this, I would very much appreciate it.

Edit: My main confusion here is that the CJIS document doesn't specify a level. Should that be interpreted as requiring Level 1 or Level 4?

  • 3
    Welcome to the world of FIPS compliance where everybody squints at the vaguely worded rules and says "Don't know what that means, but eh, I could argue my way through an audit". – Mike Ounsworth Jun 22 '16 at 16:02
  • 1
    I would interpret that as meaning any FIPS level as long as it is FIPS certified module providing the encryption. – Mr. Stone Jun 23 '16 at 18:41

I'm a FIPS tester and confirm that indeed overall level 1 means it is validated at FIPS 140-2 level 1. Different sections can be tested and validated at different levels (1-4) however the overall level defaults to the section validated at the lowest level.

  • 1
    So to answer the OP's direct question, that means their remote administrative personnel connection would meet the policy as long as the solution uses modules with any kind of FIPS certification (Level 1 or above)? – Mike Ounsworth Jun 22 '16 at 19:33
  • Yes, Mike's right. Sorry if my question isn't terribly clear - this is all pretty muzzy to me. – Kara Marfia Jun 22 '16 at 19:51
  • Finally did get confirmation that the CJIS policy referenced intends that we meet Level 1 compliance only. – Kara Marfia Oct 3 '16 at 18:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.