SEDs and FIPS 140-2 certification

[RichR]

not sure if this is the right place for a feature request.....

Companies, institutions and government are increasingly requiring FIPS 140-2 certification for data at rest. I understand the reasoning and applaud iX for adding support for SEDs, however at least for me, there's one big problem. Those drive are impossible to get. I've contacted some of our vendors; Ingram, CDW, TechData etc, and no one has the drives, and can't say when they can get them. If they were easy to get, I wouldn't be writing this.... but I do have a need, and I'm guessing others do too. HGST/Hitachi told me they are not producing SEDs any more. (although I'm not 100% trusting of who I talked to). Do an online search and see if/where you can actually buy them and they are in stock.

I'm not extremely familiar with RackTop Systems (NAS), but they seem to be growing. I do know that their systems use ZFS, and that they are FIPS certified. So are all the other big boys, but this seems to be one instance where "Find Out Why TrueNAS Is Replacing NetApp & EMC Every Day" won't happen, but I wish it would.

I think it could be a big game changer if iX/FreeNAS could incorporate FIPS 140-2 compliance into pools, through a different mechanism than SEDs. As you know the better processors support it. We have healthcare customers that we can't put on either TrueNAS or FreeNAS because of this...

Rich Rosenbaum

 

[dlavigne]

Please create the feature request at bugs.freenas.org and post the issue number here. Thanks!

 

[RichR]

thanks - not sure if Middleware is where it was supposed to go, but that's the category I used....

Feature #38928

 

[purduephotog]

Just wanted to add- I'm buying a truenas system for one customer that doesn't need it, but not having it is holding up me getting it bought for my other lab. So if you can, yes please. I have to have all data at rest 'encrypted'. Want to know what paper is called? :)

 

[RichR]

Just wanted to add- I'm buying a truenas system for one customer that doesn't need it, but not having it is holding up me getting it bought for my other lab. So if you can, yes please. I have to have all data at rest 'encrypted'. Want to know what paper is called? :)

Just to be clear, the issue is the specificity of the encryption of data at rest, which FreeNAS does offer (I'm guessing TrueNAS does too). Having FIPS 140-2 validated/certified encryption vs the currently built-in/optional encryption takes it to a level that actually means something, and meets more stringent requirements.... No company or organization is going to say "ok, just give me some kind of encryption and we don't care if it meets any standard."

 

[purduephotog]

Just to be clear, the issue is the specificity of the encryption of data at rest, which FreeNAS does offer (I'm guessing TrueNAS does too). Having FIPS 140-2 validated/certified encryption vs the currently built-in/optional encryption takes it to a level that actually means something, and meets more stringent requirements.... No company or organization is going to say "ok, just give me some kind of encryption and we don't care if it meets any standard."

Yep.

RMF - Risk Management Framework for DoD.