FIPS 140-2 Compliance

webMethods Integration Server Version 9.0 and later embeds the Entrust Authority Security Toolkit for Java 8, which has obtained FIPS 140-2 validation. FIPS (Federal Information Processing Standards) provides standards for information processing for use within the Federal government. The policy for Version 8 is available at the following:

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2012.htm#1839

Many government and financial organizations require that their software be FIPS 140-2 compliant, which follows the current standards and guidelines for cryptographic information processing.

Running Integration Server in FIPS 140-2-compliant mode ensures that it only uses FIPS compliant algorithms in the FIPS compliant modes. You can enable FIPS mode by setting the following extended setting on the Integration Server:

watt.security.fips.mode=true

Refer to Server Configuration Parameters for a detailed description of this server configuration parameter. Also, refer to Working with Extended Configuration Settings for instructions on viewing and updating extended settings for the Integration Server.

In addition to running the server in FIPS compliant mode, you must follow the other instructions in the Entrust Cryptographic Module Security Policy. The instructions include implementing safeguards such as not allowing multiple users to access the computer and ensuring that the computer is physically protected. In particular, see section 5.4 of that document ("Operational Environment"). Depending on your organization's policies, you might also be required to use the same hardware, operating system, and JDK as was used in the Entrust approval.