Be the first to like this
David Gerendas, Group Product Manager, Intel Security
Ray Potter, CEO of SafeLogic
With the advent of the cloud and the explosion of mobile endpoints, enterprises have increased their focus on maintaining data integrity and confidentiality from growing threats. As a result, the Federal Risk and Authorization Management Program, a.k.a. FedRAMP, has taken on greater significance outside of federal deployments. By standardizing requirements and expectations, the program has set a strong benchmark for the entire cloud industry. In response to repeated security breaches that have damaged brands’ credibility, corporate mandates are now matching and even exceeding their government counterparts. If you are not FedRAMP compliant, enterprises demand to know why not.
The use of encryption is integral to FedRAMP and has become ubiquitous in the effort to protect information assets. But while certain crypto algorithms are often installed alone and unverified, customer expectations have risen in recent years. Enterprises certainly no longer accept homegrown cryptography from vendors, strongly preferring to rely upon solutions that have been vetted by third-party labs and validated by the government. Federal Information Processing Standard (FIPS) 140-2 is the leading international standard for encryption and the Cryptographic Module Validation Program (CMVP) was established to certify solutions that meet the stringent benchmark. In tandem, FedRAMP and FIPS offer the highest level of assurance for cloud buyers, but both are still generally misunderstood.
You will learn:
• What FedRAMP compliance entails
• Advantages of using a validated cryptographic module in the cloud
• How encryption modules become validated and the pitfalls of the process
• Meaning of FedRAMP compliance claims and how to confirm
• Right questions to ask vendors about their encryption and FedRAMP compliance