Introduction

You can use the Forcepoint Network Security Platform in FIPS mode to comply with Federal Information Processing Standards (FIPS).

The Forcepoint Network Security Platform solution includes Security Engines, Forcepoint Security Management Center (SMC) server components, and SMC user interface components. The basic SMC components are the Management Server, Log Server, and one or more SMC Clients. The SMC Client is the user interface for the SMC. You use the SMC Client for all configuration and monitoring tasks.

There are two main ways to deploy the SMC:
  • You can use a Security Management Center appliance that ships with a Management Server and a Log Server pre-installed on it.

    You can also install the SMC Appliance as a virtual machine on virtualization platforms such as VMware ESX. For more information, see Installing SMC Appliance software on a virtualization platform in the Forcepoint Network Security Platform Installation Guide.

  • You can install the SMC components on Windows or Linux platforms.

In a FIPS environment, you must use Security Engines that run on purpose-built Forcepoint Network Security Platform appliances.

FIPS mode restrictions

When FIPS mode is enabled, the following restrictions are enforced:

  • The Security Engine local console, command line interface, and SSH access are not available
  • The available cryptographic algorithms and configuration options in the SMC are restricted:
    • RSA key sizes of 2048 bits or greater are used for digital signature generation
    • ECDSA key sizes of 256 bits or greater are used for digital signature generation
    • SHA-1 cannot be used for digital signature generation
    • The minimum password length for SMC backup encryption is 14 characters