How To Approach InfoSec Like a Fed(eral Auditor)
summary
Explains how FIPS 140-2 and Common Criteria translate to five concrete practices: define security boundary down to every physical port and logical interface (finds undocumented ports, OEM daughterboards, leftover test code), write a functional specification for each interface, maintain a key management document listing DRBG inputs and CSP locations, force encrypt internal services (LDAP, syslog) with TLS/SSH/IPsec, validate X.509 chains every use, and measure crypto strength (AES vs RSA/DH key equivalence, entropy requirements).
AI-written summary · about
chapters (12)
- 0:00Start
- 0:06Speaker Introduction
- 0:49Goals
- 1:24FIPS 140-2 Introduction
- 2:50Common Criteria Introduction
- 4:15Five Security Principles
- 5:36Define the Security Boundary
- 11:06Write a Functional Specification
- 12:52Prove the security of CSPS
- 18:49Protect (Critical) Network Traffic
- 23:42Prove the Strength of Your Crypto
- 35:00Takeaways
related talks
36mSecurity compliance: A global perspective
22mChallenges & Benefits of Certification for Security Hardware
24mGreat Security Is One Question Away
27mHow to Be Your Security Team's Best Friend
32mThe One About Controls
31mReverse Engineering Compliance
45mSecurity Architecture, An Adventure?
31mThe Art of Cybersecurity Mastery: From Entry-Level to Staff+