1.1 Enabling FIPS

IMPORTANT:

  • You cannot disable FIPS after you have enabled it.

    • The FIPS mode is enabled immediately on all the managers that have the registry module.

    • The primary registry manager is enabled first, followed by the other registry managers, and then the associated agents. Automatic re-registration of agents happens once in two days. Therefore, it might take up to two days for FIPS to be enabled automatically on all the agents because FIPS is enabled when agents re-register with a manager.

    • For agents in Offline state, FIPS is enabled only after the status changes to Online and the agents are re-registered with the manager.

Prerequisites:

  • Ensure that all the packages are upgraded to the latest version on all Privileged Access Manager agents and managers.

  • Enable FIPS on the operating systems hosting the managers and the agents.

    You can enable the FIPS mode in Privileged Access Manager for both managers and agents only on Windows and Linux. This mode is not supported on Unix. For a complete list of the supported Windows and Linux operating systems, see Privileged Account Manager 4.4 System Requirements and Sizing Guidelines.

To enable FIPS on Privileged Access Manager:

  1. Log in to the Privileged Access Manager Administration Console.

  2. Click Hosts > Host Status > Enable.

  3. (Conditional) To enable FIPS immediately on agents, re-register agents manually. For more information about re-registering agents manually, see the Privileged Access Manager Administration Guide.

  4. You must also enable FIPS on the target machines for the following components:

    • (Conditional) RDP relay

    • (Conditional) Credential checkout of applications and databases: Enable FIPS mode on Java that is installed on the system hosting the application.

1.1.1 Settings to Enable and Disable TLS Algorithms

Privileged Access Manager communicates only on TLS 1.2 and the vulnerable encryption methods are disabled to ensure the following:

  • Prevent the SWEET32 Attack

  • Handle enabling Perfect Forward Secrecy

  • Disable SSL renegotiation

NOTE:Due to Cipher Block Chaining (CBC), using TLSv1.0 or earlier makes the environment vulnerable to the BEAST attack. For more information, see Managing and Monitoring Hosts and SSL Renegotiation DOS Attack Protection.