Groove Software Obtains Key Government Security Validations.

Business Editors/High-Tech Writers

BEVERLY, Mass.--(BUSINESS WIRE)--Oct. 1, 2003

Organizations With FIPS, NIAP or DCTS Requirements

Can Immediately Deploy Groove Workspace

for Secure Collaboration & Information Sharing Needs

Groove Networks Inc., a leading provider of desktop collaboration software, today announced that the encryption technology used by Groove Cryptographic Services (GrooveMisc.dll 2.5.0.1774; cryptopp.dll 5.0.4.0) has been certified to meet two important government security standards. As a result, Groove solutions now can be deployed more broadly to government and commercial organizations that require compliance with the most recent FIPS and NIAP security specifications.

The two security standards that Groove software encryption technology meets are: FIPS 140-2 level 1 (together with supporting FIPS-approved algorithms), as defined by the National Institute of Standards and Technology (NIST), and the Common Criteria for Information Technology Security Evaluation at Evaluation Assurance Level 2 augmented with security policy model (EAL2+), as implemented by the National Information Assurance Partnership (NIAP). Earlier this year Groove Workspace obtained the first Department of Defense (DoD) certification for interoperability with version 2.0 of the Defense Collaboration Tool Suite (DCTS).

"Ensuring that commercial collaboration tools have proper and thorough compliance with security policies and specifications is essential for organizations evaluating solutions that enable sharing of sensitive information -- especially when such sharing occurs across organizational boundaries or within highly mobile environments, " said Mike Gotta, senior vice president & principal analyst with META Group, an industry analyst firm.

"Today's announcement culminates an eighteen-month effort on our part to ensure we 'walk the talk' when we claim that Groove Workspace meets military-grade security standards," said Chuck Teubner, president and COO, Groove Networks.

"We are committed to protecting the confidentiality and integrity of our customers' communications, data and intellectual capital," Teubner added. "Groove Workspace is now one of the first commercial products to be evaluated and validated by these two rigorous methodologies supported by NIST and the National Security Agency. These certifications will help us accelerate sales opportunities within organizations that have established compliance as purchasing requirements, and ultimately Groove will accelerate decision-making within these organizations by allowing more effective and secure cross-agency collaboration."

FIPS

NIST, an agency of the Commerce Department's Technology Administration, defined the Federal Information Processing Standard 140-1 (FIPS 140-1) and its successor, FIPS 140-2, as U.S. government standards that provide a benchmark for implementing cryptographic software. FIPS 140-2 specifies the security requirements that must be met by cryptographic modules within security systems that protect "sensitive but unclassified" information. The standards specify best practices for implementing crypto algorithms, handling key material and data buffers, and working with the operating system.

Entrust CygnaCom, a NIST-accredited Cryptographic Module Testing (CMT) laboratory, carried out the evaluation process of Crypto++, the open source cryptographic module used by Groove Workspace. NIST's approval of Entrust CygnaCom's findings certifies that Crypto++ meets the FIPS 140-2 security requirements. More information about Groove Networks' FIPS 140-2 validation is available at http://csrc.nist.gov/cryptval/140-1/1401val2003.htm#343.

NIAP

Originated in 1997, NIAP is a joint effort between NIST and the National Security Agency (NSA). The partnership combines the extensive security experience of both agencies to promote the commercial development of security requirements for IT products and systems, and the metrics for evaluating them. NIAP's basis for evaluation, the Common Criteria, provides an internationally recognized basis for specifying and testing a wide range of security technology, from components to products and systems.

Entrust CygnaCom completed the NIAP evaluation of the cryptographic functionality and services contained within Groove Workspace, Groove Enterprise Management Server, Groove Enterprise Relay Server, and Groove Enterprise Integration Server. Based on Entrust CygnaCom's findings, NIAP has certified that Groove cryptographic software meets the Common Criteria for Evaluation Assurance Level 2 augmented (EAL2+).

Products that are validated as conforming to the provisions of NIAP's Common Criteria Evaluation and Validation Scheme are registered by an entry in NIAP's validated products list at http://niap.nist.gov/cc-scheme/ST_VID3010.html.

DCTS

DCTS evolved from a 1999 congressional mandate to the U.S. defense and intelligence communities to address the lack of interoperability among their collaboration tools. The mandate: Develop a strategy for implementing collaboration tools throughout the DoD, and validate a prioritized list of functional requirements for DoD collaboration tools. In June of 2003, the Defense Information Systems Agency (DISA) Joint Interoperability Test Command (JITC) issued a report stating that Groove Workspace v2.5 "satisfies all collaboration interoperability requirements as a collaboration enhancement to the DCTS and is certified for joint use." If you're interested in receiving a copy of the Groove Workspace collaboration interoperability report, please send an email to [e-mail].

About Groove Software

Groove software's unique decentralized architecture provides an agile, secure and extensible collaboration infrastructure to support inter-agency decision-making. Information shared within Groove shared spaces is encrypted, both 'over the wire' and on the user's hard drive. The software, which is used by more than 40 government organizations, provides secure communication across insecure networks, is self-synchronizing, supports mobile use and a "web of trust" user authentication model that is flexible enough to meet existing organizational policies. It also isn't vulnerable to attack, since the software doesn't have a single point of failure.

About Groove Networks

Founded in October 1997 and headquartered in Beverly, Mass., Groove Networks Inc. provides desktop workspace software, powered by mobile collaboration services, to provide people a better way of working together online. Groove software helps organizations, large and small, save money, time and eliminate travel by offering both a desktop application for instant teamwork, and a set of customizable, open services for adding collaboration benefits to existing solutions. For more information about Groove Networks, visit http://www.groove.net.

Groove Networks and Groove are registered trademarks of Groove Networks Inc. All other trademarks are owned by their respective companies.