FIPS 140-3 is not a security guarantee, and auditors know it

3 comments

• afarah125 minutes ago
  Huh, I don't know about the world of HSMs or crypto and their audits, but in FedRAMP SaaS, you absolutely have to run everything with FIPS mode enabled, there are strong guarantees that need to be in place and audited.
  • bb887 minutes ago
    If the requirement causes a massive security hole, the lawyers will probably tell you that knowingly allowing a security hole from a liability perspective is worse than turning off something an audit will flag.
• sublinear35 minutes ago
  Why does the tone have to be ragebait? This is just a basic overview of what compliance looks like.
  • sscaryterry22 minutes ago
    At this point, I'd rather be waterboarded than do any more compliance. Especially in this heat.
  • PunchyHamster23 minutes ago
    because for most use cases FIPS-140 have been waste of time for everyone involved
• meehow1 hour ago
  [dead]