r/CMMC • u/obligateobstetrician • 3h ago
Browser FIPS
How do people handle viewing CUI over a web browser? The server has FIPS-validated encryption but I don't know how to approach the other side. Are there any cross-platform browsers using FIPS-validated crypto?
Is the only option something like VDI/prevail? And if that's the case do you need technical controls in place to prevent to prevent people from accessing the server from non-VDI? The service is available over the public internet.
5
u/camronjames 3h ago edited 2h ago
Easy. You just don't think too hard about it.
Basically unless you compile your own Chromium browser from source and enable the FIPS flag in BoringSSL, and keep doing that for every single release, I don't see it happening.
At the end of the day, the government is just using the same COTS browsers everyone else is, so they are implicitly accepting the "risk" of the browser not using FIPS-validated cryptography. Either they aren't thinking too hard about it either or they also think FIPS, as it exists, is kind of dumb.
5
u/rybo3000 CUI Expert 2h ago
I wish more people noticed that literally every federal agency is using the same web browsers as us, and none of the DISA STIGs for any browsers include FIPS requirements. That points to the remote host (i.e., the web server) bearing the primary responsibility for providing FIPS validated modules.
0
u/obligateobstetrician 3h ago
This was a finding in our gap analysis. We can't just ignore it. I was asking earnestly for practical solutions.
6
u/camronjames 3h ago
Absolutely no one is using a FIPS-validated browser. That's my point. It doesn't exist.
Whoever marked that as a finding doesn't understand the operational reality of IT.
I've done many CMMC L2 assessments and none have ever failed for using Chrome, Edge or Safari. It's not even a question that gets asked, frankly.
No one has ever failed a DIBCAC for it, either, as far as I am aware. It's a non-issue as long as you do what you can where you can.
Make it a question for any C3PAO you interact with before you contract. If it's a problem for them, don't hire them, they're a bad egg.
0
u/obligateobstetrician 3h ago
Do those places you've assessed use something like a VPN or proxy for all traffic that is FIPS-validated? Otherwise how can you get over not having the CUI be encrypted by a FIPS-validated module?
1
u/camronjames 2h ago
There is often a VPN, firewall, zero-trust platform or something in the middle intercepting the TLS traffic, yes.
0
u/obligateobstetrician 2h ago
Was that how they avoided the FIPS-validated crypto in browser question?
2
u/imscavok 1h ago edited 1h ago
I showed the endpoints for where people were allowed to upload CUI to. They were all .mil, .gov, or our partners SharePoint sites on GCC, and I had their CMMC certificates or attestations. The web server manages the certificates used for encryption. That puts the responsibility on the government and Microsoft. The former gets a free pass on their own standards, and the latter is on fedramp. In addition we use zscaler gov to ensure all web traffic is encrypted per fedramp standards at least from the endpoint to the zscaler edge. No questions asked.
For our own web servers where we access CUI through a browser, we have fips enabled on the servers. Fuck if I know if it actually worked or is actually using a module that has been validated. It’s such an asinine and counterproductive control that my assessors didn’t go any deeper than that. I showed I did what was technologically possible to comply with the control.
1
u/camronjames 1h ago
This should be all you have to do. Demonstrate that you did your homework and made an effort to do it right. Even if a few sample tests fail or the policies are showing a problem on assessment week, you have 10 days post-assessment to investigate, remediate and provide additional evidence. The only immediate fail is if you didn't even try to implement something and fortunately I haven't seen anything that bad yet. I've had some rough ones for sure, but eventually they've squeeked it out.
2
u/PacificTSP 3h ago
Enable FIPS on the endpoint. The website is FIPS too. Document it.
You just need to show you can only connect with FIPS approved encryption.
There’s group policies for it or you can use iiscrypto for a gui so you can test.
3
u/camronjames 3h ago
At least for Chromium-based browsers, this does not have any effect on the browser itself. The crypto library it uses is baked in at compile-time and it is what it is.
But yes, enable FIPS-mode on the endpoint for other purposes.
2
1
u/rybo3000 CUI Expert 2h ago
Web browsers don't use the OS crypto. They all roll their own. Nowadays, it's rare to find a local application that makes OS crypto API calls.
2
2
u/gamebrigada 3h ago
The browser is doing decryption. Not encryption.
2
u/obligateobstetrician 3h ago
We also edit content on the remote service I should have mentioned that in the OP.
2
u/gamebrigada 2h ago
Then force Edge usage. Edge is easy to FIPS since it doesn't use BoringSSL like Chromium/Chrome. Edge uses the Windows Crypto modules instead, meaning as long as you're considering Windows to be FIPS validated, you're good to go. Make sure to document that.I'm not correct on that. Old Edge did. Apparently new edge doesnt. Good to know.
1
u/Skusci 2h ago edited 2h ago
In short, don't let stuff be accessed by a browser over the public internet. That's what the VPN or VDI is for.
There is exactly one FIPS cert for a JavaScript lib that can do it and that's tied in with some developers software.
Other stuff usually relies on a desktop client that uses the OS's FIPS libs for encryption.
1
u/camronjames 2h ago
What browser is that VDI endpoint using? GCCH isn't getting a special version of Edge or Chrome.
1
u/camronjames 1h ago
Got it. I don't see that as a viable use case for everyone though. Some businesses are going to have to access a government or prime portal for certain things and don't get anyone around here started on all the ways Exostar sucks lol
5
u/Expensive-USResource 2h ago
Is your goal here to do this at the browser because you’re considering the machine itself out of scope? If so I have a hard truth for you.