Trellix EDR in FIPS mode

(Windows and Linux only) Trellix EDR provides an operating mode with a higher level of security for environments that require it. The Federal Information Processing Standard (FIPS) mode follows security guidelines detailed in section 140 of the Federal Information Processing Standard (FIPS).

FIPS basics

The United States Government developed the Federal Information Processing Standards (FIPS) to define procedures, architecture, algorithms, and other techniques used in computer systems. FIPS 140-2 is a government standard for encryption and cryptographic modules where each individual encryption component in the overall solution requires an independent certification.

Federal Information Processing Standard 140-2 specifies requirements for hardware and software products that implement cryptographic functionality. FIPS 140-2 is applicable to "all Federal agencies that use cryptographic-based security systems to protect sensitive (but unclassified) information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106." The "-2" in FIPS 140-2 denotes the revision of the standard.

For details about Federal Information Processing Standards (FIPS), see security requirements for cryptographic modules.

FIPS mode

Trellix EDR running in FIPS mode is FIPS validated. Install the Trellix EDR client on the endpoint running in FIPS mode to perform the cryptographic operations in a way that is validated with FIPS 140-2.

These are scenarios in which the Trellix EDR client can be installed or upgraded to operate in FIPS mode:

If you are installing the Trellix EDR client for the first time, enable the endpoint in FIPS mode, then install the Trellix EDR client on the endpoint.
If you are upgrading the Trellix EDR client when the endpoint is already enabled in FIPS mode, then reboot the endpoint.
If you have already Installed the Trellix EDR client, enable the endpoint in FIPS mode, then reboot the endpoint.

For details about the FIPS validation, see FIPS 140-2 Validation.

In FIPS mode, Trellix EDR:

Places extra constraints on the types of security methods allowed
Performs extra tests on startup
Allows connections only from FIPS-validated devices

Reasons to use Trellix EDR in FIPS mode

Your organization might need to use Trellix EDR in FIPS mode if you fall into one of these categories:

You are a U.S. Government organization needed to operate FIPS 140-2 validated cryptographic models per FISMA or other Federal, State, or local regulations.
Your organization requires the use of standardized and independently evaluated cryptographic modules.

The cryptographic boundary

FIPS validation requires an explicitly defined continuous perimeter that establishes the physical bounds of a cryptographic module.

The cryptographic boundary defines this perimeter and contains the set of hardware, software, and firmware that implements valid security functions. Only the approved set of interfaces can access the cryptographic modules inside the cryptographic boundary. No other mechanism is allowed or provided when in FIPS mode.

Modules in the boundary perform these processes:

FIPS-validated security methods performing cryptography, hashing, and related services running in Trellix EDR with Forensics
Startup and verification testing needed by FIPS
Extension and executable signature verification
TLS connection management
Cryptographic API wrapping

Trellix EDR feature status in FIPS mode

Feature status	Description
Features not available in FIPS mode	When FIPS mode is enabled on the Windows endpoints, Trellix EDR disables or ignores the MD5 hash usage. The following dashboards show the behavior of MD5 hash value: Real-time Search Collectors return a blank MD5 hash value. Reaction KillProcessByHash ignores the MD5 hash argument. You can use SHA-1 and SHA-256 hash arguments if they are set. If the query contains a condition using MD5 hash value, it is ignored and returns all results. For example — in the search query, if you run `HostInfo hostname and Files where Files full_name starts with "C:\programData" and Files md5 equals "CD72F833324EB756ED7594DC3C177B29"`, the condition `files md5 equals "CD72F833324EB756ED7594DC3C177B29"` is ignored and returns all files full name that starts with "C:\programData". Monitoring and Investigating — MD5 hash displays no value. Device Search — on the MD5/SHA-256 column, SHA-256 is displayed on priority. If SHA-256 hash is not available, MD5 hash returns a blank value. Historical Search — MD5 hash returns a blank value.

Feature status

Description

Features not available in FIPS mode

When FIPS mode is enabled on the Windows endpoints, Trellix EDR disables or ignores the MD5 hash usage. The following dashboards show the behavior of MD5 hash value:

Real-time Search
- Collectors return a blank MD5 hash value.
- Reaction KillProcessByHash ignores the MD5 hash argument.
  You can use SHA-1 and SHA-256 hash arguments if they are set.
- If the query contains a condition using MD5 hash value, it is ignored and returns all results.
  For example — in the search query, if you run HostInfo hostname and Files where Files full_name starts with "C:\programData" and Files md5 equals "CD72F833324EB756ED7594DC3C177B29", the condition files md5 equals "CD72F833324EB756ED7594DC3C177B29" is ignored and returns all files full name that starts with "C:\programData".

Monitoring and Investigating — MD5 hash displays no value.
Device Search — on the MD5/SHA-256 column, SHA-256 is displayed on priority. If SHA-256 hash is not available, MD5 hash returns a blank value.
Historical Search — MD5 hash returns a blank value.