FIPS 140-3 is not a security guarantee, and auditors know it
- A sales engineer at one of the major HSM vendors told me recently that over 90 percent of their customers who buy FIPS-enabled HSMs run them with FIPS mode disabled.
- They pay a premium for the certificate, then switch off the configuration it describes.
- By the end of this article you will understand why that is often the correct engineering decision.
Unverified
- A sales engineer at one of the major HSM vendors told me recently that over 90 percent of their customers who buy FIPS-enabled HSMs run them with FIPS mode disabled.
- They pay a premium for the certificate, then switch off the configuration it describes.
- By the end of this article you will understand why that is often the correct engineering decision.
Sources: 808bits