When it comes to data protection and encryption, the de-facto global standard is generally driven by the National Institute of Standards and Measures (NIST). NIST is the U.S. agency that defined the Advanced Encryption Standard (AES), where AES 256-bit encryption in XTS mode is the best commercial encryption available for data protection. NIST publishes standards for the U.S. government and military called FIPS (Federal Information Processing Standard) to define and approve cryptographic standards, and the FIPS 140 series is used to define hardware and software encryption security.
Why should one opt for FIPS-validated solutions? As NIST explains, “non-validated cryptography is viewed by NIST as providing no protection to the information or data—in effect the data would be considered unprotected plaintext.”
FIPS 140-2 was approved in May 2001 and has been in effect for over 20 years, while computing power has increased exponentially in that time frame. While FIPS 140-2 is still considered strong military-grade security, NIST published the FIPS 140-3 standard and approved it in September 2019. To ensure compliance, NIST set up certified laboratories that conduct rigorous reviews and tests of software and physical drives for the industry, with results being reviewed by NIST scientists prior to the official award of a FIPS 140 series certificate.
Storage drives which are compliant with FIPS 140-3 have been launched since 2023, so governments and enterprises should start switching to FIPS 140-3 drives. These drives come with enhanced levels of protection, of which Level 3 is the gold standard with anti-tampering resistance to detect physical intrusion attempts using special epoxy on the physical circuitry.
