When you are creating a HIPAA compliant system on cloud service like AWS \/ EC2 \/ S3, you have to carefully examine the different levels of data security provided by the Cloud Service provider<\/p>\n
At a minimum level, the following should be ascertained:<\/p>\n
i) Where is the Cloud provider\u2019s data center physically located. In some countries, HIPAA restricts Protected Health Information ( PHI ) to be stored on servers located outside of the country.<\/p>\n
ii) Whether the cloud provider contractually obligated to protect the customer\u2019s data at the same level as the customer\u2019s own internal policies?<\/p>\n
iii) Cloud provider’s Backup and Recovery policies<\/p>\n
iv) What are the provider\u2019s policies on data handling\/management and access control? Do adequate controls exist to prevent impermissible copying or removal of customer data by the provider, or by unauthorized employees of the company?<\/p>\n
v) What happens to data when it is deleted? This is very important as customers will be storing data on virtual Machines. Also What happens to cloud hardware when the hardware is replaced?<\/p>\n
In this blog we are only looking at the different security levels to be taken by the application developer to make sure that a web application built on AWS \/ EC2 using Windows Server 2008 \/ .NET \/ MSSQL \/ IIS 7 \/ is HIPAA compliant. The basic requirement is to encrypt all the data at rest and transit<\/p>\n
1. Encrypting Data in transit between the user ( clients ) and the server ( Webserver ) <\/strong> Steps used to Implement SSL on IIS are the following:<\/p>\n [bash] 7. From the “Actions” menu (on the right), click on “Bindings.” This will open the “Site Bindings” window<\/p>\n 8. In the “Site Bindings” window, click “Add” This will open the “Add Site Binding” window<\/p>\n 9. Under “Type” choose https. The IP address should be the IP address of the site , and the port over which traffic will be secured by SSL is usually 443. The “SSL Certificate” field should specify the certificate that was installed in step 5.<\/p>\n 10.Click “OK.” . SSL is now installed . 2 ) Encrypting Data at Rest ( Document Root )<\/strong><\/p>\n EFS with IIS <\/strong><\/p>\n You can use EFS ( Encrypted File System ) in Windows 2008 Server to automatically encrypt your data when it is stored on the hard disk.<\/p>\n Encrypt a Folder:<\/p>\n [bash] The folder becomes an encrypted folder. New files that you create in this folder are automatically encrypted<\/p>\n TDE ( Transparent Data Encryption ) <\/strong><\/p>\n TDE is a new feature inbuilt in MSSQL Server 2008 Enterprise Edition . Data is encrypted before it is written to disk; data is decrypted when it is read from disk. The “transparent” aspect of TDE is that the encryption is performed by the database engine and SQL Server clients are completely unaware of it. There is absolutely no code that needs to be written to perform the encryption and decryption .So there is no need for changing any code ( Database Queries ) in the Application .<\/p>\n STEPS<\/p>\n i) Create a Master Key<\/p>\n A master key is a symmetric key that is used to create certificates and asymmetric keys. Execute the following script to create a master key:<\/p>\n [bash] ii)Create Certificate<\/p>\n Certificates can be used to create symmetric keys for data encryption or to encrypt the data directly. Execute the following script to create a certificate:<\/p>\n [bash] iii) Create a Database Encryption Key and Protect it by the Certificate<\/p>\n [bash] You can query the is_encrypted column in sys.databases to determine whether TDE is enabled for a particular database.<\/p>\n [bash] MSSQL secure connection using SSL<\/p>\n i) Creating a self-singned cert using makecert ii) Install this cert<\/p>\n [bash] iii) Open SQL Server Configuration Manager<\/p>\n [bash] Now SSL is ready to be used on the server. The only modification needed in the .NET code is connection string. It will be<\/p>\n [bash] When you are creating a HIPAA compliant system on cloud service like AWS \/ EC2 \/ S3, you have to carefully examine the different levels of data security provided by the Cloud Service provider At a minimum level, the following should be ascertained: i) Where is the Cloud provider\u2019s data center physically located. In some […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[52,34,50,51,3],"tags":[83,4,129,471,20,478,127,215,480,481,476,470,472,465,466,473,468,464,84,116,82,467,463,474,81,482,477,85,18,479,300,77,136,469,241,79,475,80],"class_list":["post-928","post","type-post","status-publish","format-standard","hentry","category-amazon-ebs","category-amazon-ec2","category-amazon-s3","category-amazon-web-services","category-cloud-computing","tag-net","tag-amazon","tag-amazon-ec2","tag-application-developer","tag-aws","tag-city-click","tag-cloud-computing","tag-cloud-infrastructure","tag-cloud-service","tag-company-aes-corp","tag-company-microsoft","tag-data-encryption","tag-database-encryption","tag-electric-utilities-nec","tag-encryption","tag-encrytion-algorithm","tag-general","tag-health-insurance-portability-and-accountability-act","tag-hipaa","tag-http","tag-iis-7","tag-iis-manager","tag-internet-information-services","tag-key-encryption","tag-mssql","tag-mssql-server-management-studio","tag-open-sql-server-configuration-manager","tag-pci","tag-s3","tag-set-database-encryption","tag-software-nec","tag-ssl","tag-technologyinternet","tag-transparent-data-encryption","tag-web-application","tag-windows","tag-windows-2008","tag-windows-server-2008"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t
\n
\nSSL over HTTP ( HTTPS ) <\/strong><\/p>\n
\n1.Open IIS Manager.
\n2.Click on the server name.
\n3.Double-click the “Server Certificates” button in the “Security” section
\n4.Click on self-signed certificate
\n5.Enter certificate name and click ok
\n6. Select the name of the server to which the certificate was installed.<\/p>\n
\n[\/bash]<\/p>\n
\n1. Open Windows Explorer.
\n2. Right-click the folder that you want to encrypt , and then click Properties.
\n3. On the General tab, click Advanced.
\n4. Under Compress or Encrypt attributes, select the Encrypt contents to secure data check box and then click OK.
\n5. Click OK.
\n6. In the Confirm Attribute Changes dialog box that appears, use one of the following steps:
\ni) If you want to encrypt only the folder, click Apply changes to this folder only, and then click OK.
\nii) If you want to encrypt the existing folder contents along with the folder, click Apply changes to this folder, subfolders and files, and then click OK.
\n[\/bash]<\/p>\n
\n3 ) Encrypting MSSQL Database ( Data at Rest ) <\/strong><\/p>\n
\nUSE master;
\nCREATE MASTER KEY
\nENCRYPTION BY PASSWORD = ‘Pass@word1’;
\nGO
\n[\/bash]<\/p>\n
\nCREATE CERTIFICATE TDECert
\nWITH SUBJECT = ‘TDE Certificate’
\nGO
\n[\/bash]<\/p>\n
\n1.Go to object explorer in the left pane of the MSSQL SERVER Management Studio
\n2.Right Click on the database on which TDE Requires
\n3.Click Tasks and Navigate to Manage Database Encryption
\n4. Select the encrytion algorithm (AES 128\/192\/256) and select the certificate you have created
\n5.Then Mark the check Box for Set Database Encryption On
\n[\/bash]<\/p>\n
\nSELECT [name], is_encrypted FROM sys.databases
\nGO
\n[\/bash]<\/p>\n
\n4 ) Encrypting Data in transit between the Webserver and the MSSQL Database<\/strong><\/p>\n
\n[bash]
\nmakecert -r -pe -n “CN=YOUR_SERVER_FQDN” -b 01\/01\/2000 -e 01\/01\/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp “Microsoft RSA SChannel Cryptographic Provider” -sy 12 c:\\test.cer
\n[\/bash]<\/p>\n
\nCopy c:\\test.cer into your client machine, run c:\\test.cer from command window, select “Install Certificate”. -> click “Next” -> select “Place all certificates in the following store” –> click “Browser” -> select “Trusted Root Certification Authorities” -> select OK and Finish
\n[\/bash]<\/p>\n
\nExpand SQL Server Network Configuration, right-click “Protocols for MSSQLSERVER” then click “properties”. On the “Certificate” tab select the certificate just installed . On the “Flags” tab, set “ForceEncryption” YES.
\n[\/bash]<\/p>\n
\nconnectionString=”Data Source=localhost;Initial Catalog=mydb;User ID=user1;Password=pas@123;Encrypt=true;TrustServerCertificate=true”
\n[\/bash]<\/p>\n","protected":false},"excerpt":{"rendered":"