Risk

9/27/2018
12:15 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Blue Cedar Teams Up with OpenSSL, Akamai, NetApp, VMware to Build Next-Gen FIPS Module

New FIPS Module for OpenSSL will democratize access to widely used cryptographic library.

SAN FRANCISCO, September 27, 2018 – Blue Cedar today announced it has joined an industry initiative to develop the next-generation open-source FIPS 140-2 module for OpenSSL. Blue Cedar will collaborate with established industry leaders, including Open SSL, Akamai, NetApp, and VMware, in the effort to upgrade and improve secure data transfers using the OpenSSL cryptographic library. Updating the open source FIPS 140-2module, which is currently used by millions of web servers and internet-connected devices, will make it easier for companies to comply with the ubiquitous TLS and SSL open source cryptographic standards. 

FIPS (Federal Information Processing Standard) 140-2 is the widely accepted certification standard used by government agencies, financial, healthcare, and other industries as the de facto standard for certification of the cryptographic modules used within commercial and open source products. FIPS 140-2 certification ensures strong and validated cryptographic protection for data at rest and data in transit across networks. 

The current FIPS 140-2 module for OpenSSL is overdue for an upgrade. The last significant update was in 2012, and encryption standards have evolved considerably since then. Until a FIPS 140-2 validated cryptographic module is available for OpenSSL, federal agencies and organizations are forced to rely on older, less secure implementations of OpenSSL.

“Today, if a small company wishes to engage with a government, bank, or healthcare system, it can do one of two things to meet the FIPS 140-2 certification requirement: build its own cryptographic library or buy one at great expense,” said Kevin Fox, CTO at Blue Cedar. “We are proud to be joining with other key players in the Free and Open Source Security (FOSS) community to develop an option that will maintain an open standard with truly secure cryptography that is accessible to all.”

Blue Cedar, which specializes in powerful, in-app security solutions that protect mobile and other edge apps and data whenever and wherever they are used, is contributing its expertise and other resources to the FIPS 140-2 module development effort. Last month, an expert team of Blue Cedar security engineers took part in a face-to-face meeting in Brisbane, Australia where members of the consortium and partner organizations focused on a modernized implementation of FIPS 140-2 that can support the community now and in the future.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8902
PUBLISHED: 2019-02-18
An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI.
CVE-2019-8423
PUBLISHED: 2019-02-18
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.
CVE-2019-8424
PUBLISHED: 2019-02-18
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter.
CVE-2019-8425
PUBLISHED: 2019-02-18
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages.
CVE-2019-8426
PUBLISHED: 2019-02-18
skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter.