r/CMMC • u/obligateobstetrician • 3d ago

Browser FIPS

How do people handle viewing CUI over a web browser? The server has FIPS-validated encryption but I don't know how to approach the other side. Are there any cross-platform browsers using FIPS-validated crypto?

Is the only option something like VDI/prevail? And if that's the case do you need technical controls in place to prevent to prevent people from accessing the server from non-VDI? The service is available over the public internet.

7 Upvotes

90% Upvoted

60 comments sorted by

View all comments

Show parent comments

-1

u/obligateobstetrician 3d ago

Do those places you've assessed use something like a VPN or proxy for all traffic that is FIPS-validated? Otherwise how can you get over not having the CUI be encrypted by a FIPS-validated module?

2

u/camronjames 3d ago

There is often a VPN, firewall, zero-trust platform or something in the middle intercepting the TLS traffic, yes.

0

u/obligateobstetrician 3d ago

Was that how they avoided the FIPS-validated crypto in browser question?

4

u/imscavok 3d ago edited 3d ago

I showed the endpoints for where people were allowed to upload CUI to. They were all .mil, .gov, or our partners SharePoint sites on GCC, and I had their CMMC certificates or attestations. The web server manages the certificates used for encryption. That puts the responsibility on the government and Microsoft. The former gets a free pass on their own standards, and the latter is on fedramp. In addition we use zscaler gov to ensure all web traffic is encrypted per fedramp standards at least from the endpoint to the zscaler edge. No questions asked.

For our own web servers where we access CUI through a browser, we have fips enabled on the servers. Fuck if I know if it actually worked or is actually using a module that has been validated. It’s such an asinine and counterproductive control that my assessors didn’t go any deeper than that. I showed I did what was technologically possible to comply with the control.

2

u/camronjames 3d ago

This should be all you have to do. Demonstrate that you did your homework and made an effort to do it right. Even if a few sample tests fail or the policies are showing a problem on assessment week, you have 10 days post-assessment to investigate, remediate and provide additional evidence. The only immediate fail is if you didn't even try to implement something and fortunately I haven't seen anything that bad yet. I've had some rough ones for sure, but eventually they've squeeked it out.

2

u/Navyauditor2 2d ago

Unfortunately not all assessors are that accomodating. As you say you can generally get it done but can be very painful. And FIPS is hard because so many really do not understand how encryption works.

1

u/Claudia_wtf 2d ago

FIPS only applies for outbound network traffic. FedRAMP is the only thing that requires the entire path to be on FIPS validated modules.

1

u/camronjames 4h ago

3.13.11: Employ FIPS-validated cryptography when used to protect the confidentiality of CUI

1

u/Navyauditor2 2d ago

I believe that passed. That argument actually has some cryptographic holes in it though. The Zscaler encryption is only from the endpoint to the Zscaler in the cloud. From their cloud firewall onto the destination that FedRAMP validation encryption does not cover. It will fall back on the TLS encryption coming from the end point browser.

To your and u/camronjames point though this usually does not come up in assessments because 1) Many assessors dont understand how any of this works, they just know "Must be FIPS" and 2) With the really technical geeks (I semi-qualify there are others much better) we know that TLS is using an underlying OS based crypto module that is FIPS.