Security Guidelines

Owned by Taib
Last updated: Sept 29, 2024
2 min read

Port Configuration and Networking

  • Only required ports should be open on the server. By default, all ports should be closed, except 22,80 and 443. Reverse proxies can be used to route all traffic to these ports.

  • Put up a firewall,Firewalls act as a barrier to prevent the spread of cyber threats such as viruses and malware and a firewall has to be set up.

  • Setup a VPN,a VPN encrypts web traffic by creating a tunnel between the computer and the network, which hides activities from the Internet Service Provider (ISP).

  • For Central HIE deployment, it is recommended to use load balancing, or more than one server to spread out functionality to not put too much load on any particular server, but the following is a rough guide for hardware:

Port Scanning
Port Scanning General penetration testing

Server Certificates and Domains

  • The server should run with updated certificates.

  • The server should have a domain name.

Password Requirements

  • Strong passwords should be used for all the different applications.

  • Default passwords, like bad passwords (admin123, root, etc.) should NEVER be used.

  • Discourage using the same password with the same username as other applications.

  • The use of password managers is highly encouraged.

  • Passwords should be changed in-line with a password expiration policy. An expiration policy should be no more than every 3 months, and no less than every time after a suspected data breach.

Monitoring and Notifications

  1. Monitor for intrusion

  2. If a detection system suspects a potential security breach, it can generate an alarm, such as an email alert

HIE Hardware Recommendations

  1. Hard Disks: The more space the better, but they should always be in a redundant RAID configuration with a backup to another server. I would not want to start with less than 10TB of space.

  2. Memory: 32 GB RAM minimum, More is better if possible. Some actions take a lot of memory space, so this is an important factor.

  3. CPU: Any server-grade CPU will work.

Backups and Restoration

  1. Define a RTO and RPO for your database. To minimize RPO, database replication via data streaming is recommended.

  2. Follow 3-2-1 backup strategy

  3. Total server backup can occur less frequently, but should still be quite regular

  4. Define a restoration procedure that fits within your RTO

Software/Application Management

  1. Software on the server should be kept up to date to take advantage of the latest security fixes

  2. Software on the server should be kept minimal to minimize the number of potentially insecure applications. This involves removing no longer needed programs and not installing unnecessary programs on the server and in containers.

  3. Don’t run applications as root unless absolutely necessary

Secure Access

  1. Physical servers: physical access needs to be managed, and total disk encryption should be used

  2. SSH access: Principle of least privilege should be applied. Sudo access should only be given to employees and contractors that need it.

Automation

  1. Most security controls should be set up to run automatically, or with minimal user interaction. These include backups, updates, monitoring, certificate renewal, etc.