FIPS for RabbitMQ – How to ensure compliance

In today’s digital age, secure message brokering is crucial for the integrity and confidentiality of data in transit.  For organisations dealing with sensitive information, such as government, healthcare, financial services, defence and critical infrastructure, this security is even more paramount, and indeed mandatory in certain regions.  

The US federal government, for example, ensures the security of data processing and transmission for US government computers and contractors with the Federal Information Processing Standards (FIPS 140-2).  These standards, specified by the National Institute of Standards and Technology (NIST) are crucial for:

1. Ensuring data security which involves protecting sensitive information with encryption and secure practices, crucial for preventing unauthorised access and maintaining information integrity.

2. Regulatory compliance which is required for organisations handling government data, necessitating adherence to legal and contractual standards to ensure operational integrity and maintain eligibility for government contracts.

3. Maintaining trust which is key to establishing a system’s reliability and security, enhancing stakeholder confidence and underlining an organisation’s credibility in protecting sensitive information.

So how can organisations ensure FIPS compliance?

RabbitMQ, a leading open-source message broker, is at the forefront of facilitating efficient communication between parts of software systems. Achieving FIPS compliance with RabbitMQ relies on cryptographic operations within RabbitMQ meeting the stringent requirements outlined by FIPS.

Here’s how…

RabbitMQ and FIPS: A Secure Combination

Integrating FIPS compliance into RabbitMQ involves ensuring that all components of the RabbitMQ environment that deal with data encryption and transmission adhere to FIPS standards.

Just like any application level software product it depends on the infrastructure and operating environment to be FIPS compliant. This includes ensuring the OS is set to FIPS mode, affecting how cryptographic operations are handled system-wide. Part of this process is to use the verified and compliant cryptographic libraries such as OpenSSL in FIPS mode for all encryption tasks.

The other major generic component of FIPS compliance is to use TLS/SSL certificates with approved and compliant algorithms. FIPS 140-2 limits suitable algorithms which all connected services need to agree, thus the compliance process doesn’t start or stop with RabbitMQ.

When it comes to FIPS-compliant RabbitMQ, the two major steps are:

Preparing FIPS-compliant distributions for both RabbitMQ and the BEAM (Erlang) virtual machine that drives it.
Deploying and configuring both components to enable FIPS mode.

The BEAM Virtual machine does the heavy lifting in FIPS compliance by using the cryptographic library (e.g. OpenSSL) in the recommended way. This requires a specific deployable package of the BEAM which was compiled with the appropriate OpenSSL library on the target architecture. The official RabbitMQ package is already FIPS compatible but requires further configuration.

Though FIPS-compliance enables the benefits of a secure system, it also comes with natural performance trade-offs. All data that travels to, from and through a RabbitMQ cluster will be encrypted which adds to the workload and latency. Workload decreases the maximum message throughput, while latency affects the amount of time a message travels from publishers to consumer applications. These trade-offs need to be balanced which may require adjusting the non-security related configuration of RabbitMQ as system.

Once compliance is achieved the overall solution needs to be tested and verified. Security also requires proper monitoring and operational procedures to guarantee the long-term reliability and availability of the RabbitMQ system.

Partner with experts to safeguard compliance

When utilising RabbitMQ, ensure that deployment is not only FIPS-compliant but optimised for performance and reliability too. Working with a seasoned RabbitMQ partner will ensure that your message brokering is secure whilst getting the best from this component of your tech stack.

A good partner can assist in FIPS-compliance by providing the necessary packages and instructions for the target architecture, assess the runtime of the FIPS enabled and offer fine tuning where necessary, as well as full implementation.

At Seventh State we can help with tailored consultation, custom implementation and ongoing support:

Tailored Consultation – understanding your specific needs and compliance requirements

Custom Implementation – configuring and testing your RabbitMQ environment to meet FIPS standards.

Ongoing RabbitMQ Support – providing maintenance and updates to ensure continuous compliance with FIPS and other relevant standards