Can SonarQube scan the source code for FIPS 140-2 compliance?

[Pooja_Chowdhary]

Hi ,

Can SonarQube be used to scan source code to check for FIPS 140-2 compliance?

FIPS (Federal Information Processing Standards) are a set of standards that describe document processing, encryption algorithms and other information technology standards for use within non-military government agencies and by government contractors and vendors who work with the agencies in US. We are trying to specify if our software components are FIPS compliant or not.

[anon67236913]

Welcome

there was already a similar question in 2020, the answer was

Check for FIPS 140-2 compliance using SonarQube

Hi @kirann welcome to the community! Recently, we have greatly improved SonarQube cryptography rules for the Java language, see for example this product announcement. Some of these rules are based on FIPS or other NIST recommendations, for example the rule S4426 is based on the NIST special publication 800-131a which is pretty aligned with FIPS (or even stricter). Depending on the development language of your software components, SonarQube can currently be a great help in achieving FIPS compl…

Gilbert

[Pooja_Chowdhary]

Thank you for you response.
The publication mentioned in this post is quite old. Does the aforementioned rule support this publication - SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations | CSRC

[ganncamp (G Ann Campbell)]

Hi,

Notwithstanding the fact that we map rules to applicable sections in standards, Sonar doesn’t offer compliance tools. So even if we had FIPS-related rules (which I don’t believe we do), you wouldn’t really be able to use SonarQube to show FIPS compliance.

That said, I’m going to flag this for the Product Managers so they can log your interest in FIPS-related rules.

 
Ann

[Alexandre_Gigleux]

Hello,

We are working on two topics related to FIPS these days:

• Support running SonarQube in a FIPS-enforced environment
• Map our existing security rules to this particular STIG U_ASD_V5R3_STIG STIG
  Application Security and Development Security Technical Implementation Guide

If our understanding of the FIPS 140-2 compliance is correct, to be compliant with FIPS everything you use to make and run your software must comply with the 240+ STIGs. When we looked at these 240+ STIGs, only the U_ASD_V5R3_STIG STIG was related to code and static analysis.

The effort to map our security rules to U_ASD_V5R3_STIG STIG is done on our side, and the result of this should normally be a report that will show you if you have issues that you must fix in order to have no discrepancy related to the FIPS compliance. We won’t tell you that your code is compliant (I’m not sure anyone can do that on the market), but we will be here to help your developers in that direction. That should come for the next LTS/LTA, which is scheduled for Sept 2024.

Meanwhile, using SonarQube Developer Edition+ will definitely help you toward getting FIPS 140-2 compliance by helping you find and fix security issues.

I would love to hear your perspective and how you approach FIPS 140-2 compliance. Would you be up for a quick call with us?

Alex