We currently use IronPort Encyption appliances for encrypting outbound e-mails.
Our customers are asking if these devices are FIPS compliant? They are reading this somewhere:
AsyncOS for Email 7.3 provides support for the Cisco IronPort Email Security appliance with a FIPS-compliant Hardware Security Module (HSM) card.
The Federal Information Processing Standard (FIPS) 140 is a publicly announced standard developed jointly by the United States and Canadian federal governments specifying requirements for cryptographic modules that are used by all government agencies to protect sensitive but unclassified information. The HSM offered with the Cisco IronPort C670 Email Security appliance is the CAVIUM Nitrox XL CN15xx-NFBE Cryptographic Module, which complies with the FIPS 140-2 Level 2 standard. This standard specifies additional protections for information used in cryptographic operations, including the use of a tamper-resistant hardware keystore for private keys.
The HSM card provides cryptographic processing for the appliance as well as storage for private keys. All cryptographic operations take place within the secure environment of the HSM card.
When the Email Security appliance includes the HSM card and uses AsyncOS 7.3, it offloads all cryptographic operations to the HSM card in a FIPS-compliant manner. AsyncOS for Email 7.3 also provides a FIPS management console to allow a FIPS Officer to configure the HSM card to manage certificates and private keys.”
Are the IEA appliances FIPS compliant?
Jason Meyer
