SSH Communications Security (SSH) is proud to announce that its Just-in-Time Privileged Access Management (PAM) solution PrivX is one of the first PAMs to achieve Federal Information Processing Standard (FIPS) 140-3 certification (SSH Communications Security Cryptographic Module #5020) through the Cryptographic Module Validation Program (CMVP). The CMVP aims to ensure that validated and FIPS compliant cryptographic modules are secure and reliable for use in government and contractor applications for enhanced data protection. Working with SSH-based solutions or cryptographic libraries that are government-facing or standards-driven, aligning with FIPS 140-3 can be crucial for compliance and market acceptance.

The CMVP program is a joint effort between the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security. The recently published PrivX Release 40 comes equipped with FIPS 140-3, bringing the following benefits for PrivX: 

• Improved compliance: Industries such as government, defense, finance, and healthcare are required by law or regulation to use FIPS-validated cryptography.
• Tested: It’s an independent, government-recognized and highly regarded security validation.
• Global reach: FIPS 140-3 is aligned with international standards (ISO/IEC 19790) and recognized beyond North America.
• Future-proofing: FIPS 140-3 replaces older FIPS 140-2, and only FIPS 140-3 is accepted for U.S. federal procurements or deployments soon. FIPS 140-3 also introduces enhancements, such as stricter requirements for module integrity, authentication, and protection against physical and environmental attacks.

“As more and more organizations are looking to modernize their IT stack, they turn to solutions that fulfill the latest requirements, like FIPS 140-3, and are built on modern technologies. PrivX has scalable microservices architecture, is highly automated, integrates out of the box with other security systems and provides just-in-time, passwordless access to keep organizations secure and people productive. We have long been in the federal government market, and adding the FIPS 140-3 certification for PrivX PAM enables us to win new business in the North American market and beyond,“ states Rami Raulas, CEO of SSH.
 
Learn more about PrivX Just-in-Time PAM here.