Company Large Government Organization
Across all industries and geographies, more and more government agencies are swapping out their EAL-certified Secure KVM switches for NIAP-certified switches. A government organization was compelled to find a suitable option. The organization reached out to our sales engineer at Black Box with their need to go to a NIAP version and received a first introduction to Black Box’s broad NIAP PP 4.0 portfolio.
Next, our Black Box team with members from Sales, Application Design, and Product Management met with the government organization’s information assurance team. As a government organization, security is a top requirement for any new products. To allay the organization’s concerns about the security offered by NIAP 4 switches, we described why NIAP is inherently more secure than EAL, giving a snapshot of the differences between NIAP 3 and 4 in comparison to EAL.
Our product manager explained, “In a point-by-point board-level (PCB) analysis, the complexity of the testing process and the requirements toward certification are both more complex and more secure for NIAP certification than for EAL certification. We provided all required testing documents from our certification board along with samples for the customer to review.”
Specifically, here are the main differentiators between NIAP and EAL in testing and certification:
NIAP:
All vendors within the same product type must adhere to the same security requirements
Evaluation methods approved by the Common Criteria Recognition Arrangement
An objective approach in evaluation methods
Relevant, achievable, repeatable results with standard threat models and security functional requirements that must be captured in a Protection Profile
Protection Profiles developed by technical communities through the Common Criteria community
Threats identified and mandated by the NSA and other international security agencies; hardware requirements based on threats
EAL:
Vendor individually chooses which security requirements to claim, causing inconsistencies across similar products
Limited recognition from the Common Criteria Recognition Arrangement, only up to EAL2
A subjective approach to identify product functional requirements
Protection profiles not used, and results not repeatable across different products and vendors
Generic requirements developed by individual vendors
Threats identified after vendor maps product functionality to Common Criteria, causing differing hardware requirements and less assurance
After the Black Box team together with the users completed several product demos, they identified, discussed and overcame possible issues, leading to the customer’s decision to order our NIAP 4.0 Dual-Monitor Secure KVM Switches with FlexPort HDMI/DP combo ports. Throughout their organization, about 10,000 EAL switches will be replaced with our NIAP switches. Our sales engineer said, “We assumed the rollout was going to be in one go, but it won’t happen that fast because of budget constraints. Instead, the rollout will be gradual over 5 years.”
For budget reasons, they will keep using some existing EAL switches until they die out, and they are not allowed to buy any more EAL switches. The executed NIAP 4.0 replacement works to the full satisfaction of the customer and the project continues until all EAL switches are end-of-life and are replaced with NIAP switches.
Our product manager commented, “We spoke to the right people with the right info, which ultimately resulted in upgrading their application to the latest available security standard.”
Black Box is maintaining contact with the customer and exploring opportunities for additional product applications. To further enhance opportunities, as part of this ongoing deal, our sales engineer invited the customer to visit our control room environment demo suite in our office to make their team aware of NIAP, as well as introduce Black Box control room solutions useful for their secure environment, including Emerald® IP KVM Matrices with the Emerald DESKVUE receiver for a tailored workspace with instant situational awareness, and KM Switches. The meetings revealed additional opportunities for CCTV digital specialists who were interested in Secure Desktop KVM as well as our solutions to enhance public-safety control rooms.
Recently, a tender was opened for NIAP single-monitor switches and it turned out that the customer can instead purchase additional NIAP switches like the ones they currently have in place to meet this need without any further testing and procurement setups.
From the initial inquiry about NIAP Secure KVM Switches to the additional opportunities encountered along the way, the Black Box team worked diligently to bring outstanding NIAP solutions to its valued customers.
Download PDF
Industry: Government
Solution: Control Rooms & Command Centers
Products: Secure KVM
