Hp Secure Key Manager User Manual download pdf (Page 170)

Only the following models are capable of operating in accordance with FIPS standards:

• HP DL360 R05

All other SKM can be configured for high security but cannot be FIPS-compliant

Advanced Security Access Control

Altering the security settings on the High Security Configuration page can have a profound effect on

the security of your HP platform and alter your compliance with FIPS standards. For this reason,

administrators must have the Advanced Security Access Control to modify these settings.

FIPS Compliance

The FIPS standards describe hardware and software parameters that must be met for full compliance.

HP provides both FIPS-compliant hardware and software security settings to enable all SKMs to operate

with the highest software security settings described in the FIPS standards. However, since FIPS

compliance includes both hardware and software, FIPS compliance can only be fully achieved by

using a FIPS-capable SKM.

SKM Settings Required for FIPS Compliance

In order to comply with FIPS 140-2, Level 2, the following functionality must be disabled on the SKM:

• Administrative options on XML interface (only if SSL is not enabled)

• FTP transport for importing certificates and downloading and restoring backup files

• LDAP authentication

• LDAP administrator server

• Use of the following algorithms: RC4, DES, RSA-512, RSA-768. These algorithms are not available

when FIPS compliance is enabled.

• SSL 2.0 and SSL 3.0*

• Hot-swappable drive capability

• RSA encrypt/decrypt operations**

* We recommend running TLS over the XML interface. This requires that you generate a certificate

and enable it.

**RSA encrypt/decrypt associated with TLS handshakes and Sign and Sign Verify are permitted.

These settings are adjusted automatically when you use the Management Console's High Security

Configuration page to enable FIPS compliance on FIPS capable SKMs.

Clustering

Clustering FIPS-compliant devices with non-FIPS-compliant devices will disable FIPS for all devices in

the cluster.

Backups

FIPS and non-FIPS devices cannot share backups.

FIPS Self-Test

To run a FIPS self-test on the SKM, powercycle the device.

Using the Management Console170

1 2 ... 165 166 167 168 169 170 171 172 173 174 175 ... 351 352

No comments

Hp Secure Key Manager User Manual Page 170