Protect Your Agency’s Machine Identities
Protecting machine identities is a vital part of managing network access controls to secure your critical infrastructure. Keys and certificates are used to uniquely identify and create trusted relationships between machines, devices and systems. They govern the flow of information to trusted machines and prevent the flow of information to those that are not trusted. So, it’s important that agencies maintain tight control over them.
OMB M-15-13 (HTTPS-Only standard) mandates that federal agencies encrypt communications across federal government. To prevent misuse, these encrypted communications rely on digital certificates and cryptographic keys and to verify the identities of the machines engaged, in much the same way that federal employees identify themselves with CAC and PIV cards.
The Continuous Diagnostics and Mitigation (CDM) program outlines specific requirements for the use and management of encryption in BOUND E guidelines. As you extend encryption deeper into your agency, you’ll need the ability to monitor and protect the keys and certificates that govern the identity and authenticity of your agency’s machines and the data they transmit.
Having earned Common Criteria Certification from the National Information Assurance Partnership’s (NIAP) Common Criteria Testing Laboratory (CCTL), the Venafi Trust Protection platform helps Federal agencies manage and secure the cryptographic keys and digital certificates that make up machine identities. Using the Venafi platform, agencies can efficiently orchestrate the entire machine identity lifecycle, keeping communications between machines secure and private. This in-depth intelligence can help your agency sidestep the failures in cryptographic devices and mechanisms that have contributed to past security breaches at government agencies.
The Venafi Trust Protection Platform (TPP) integrates with FIPS validated hardware to maximize the security of the assets it manages. Venafi TPP runs on Microsoft Windows Server 2012 R2 in FIPS mode and TPP uses Microsoft FIPS certified libraries for cryptography operations.
In addition, TPP has the ability to integrate with one or more FIPS 140-2 Level 2 configured HSMs to store and secure symmetric keys used for encrypting private keys and other sensitive information in the TPP database. Information regarding the FIPS validation of Microsoft Windows Server 2012 R2 in FIPS mode is available at: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#1335
OMB M-15-13 also dictates that government should “deploy HTTPS in a manner that allows for rapid updates to certificates, cipher choices (including forward secrecy) protocol versions, and other configuration elements.” Venafi Trust Protection Platform gives your agency the visibility and control over your keys and certificates to respond quickly and completely to events that require a rapid update or agency-wide replacement of your certificates.
Built to withstand the rigors of even the most classified “high side” networks, the Venafi platform will help you comply with mandates that pertain to protecting machine identities.
Extending Protection to Nonfederal Organizations
In addition to mandating protection for encryption within its own agencies, the Federal government also requires similar protection for Federal contractors. NIST 800-171 is designed to protect Controlled Unclassified Information (CUI)—whether at rest or in transit—in nonfederal organizations. Learn more about how Venafi helps nonfederal organizations ensure secure authentication, access control and confidentiality of communications. Download a quick reference for NIST 800-171 compliance.