Thread: [GENERAL] Securing Information

On Tue, 27 Dec 2016, Chris Weekes wrote:

> I was wondering what steps if any need to be taken to ensure that the
> patient and operational data is secure on a machine and or across the
> network.

Chris,

   I'm far from an expert but until more knowledgeable folks respond I'll
offer a couple of quick suggestins. First, in your postgres data/ directory
modify pg_hba.conf. Specifying hostssl and an appropriate authentication method
will help. Second, partition your users into postgres role specifying what
each role can access and do.

   The postgresql-9.6-US.pdf manual has all the details.

HTH,

Rich

On 12/27/2016 11:59 AM, Chris Weekes wrote:
> Hello Sir or Madam:
>
> I wanted to install PostgreSQL v 9.6 on a machine that may
> stand alone and or be part of a network sharing hospital
> data.
>
> I was wondering what steps if any need to be taken to ensure
> that the patient and operational data is secure on a machine
> and or across the network.

That is a large question that depends to a great deal on what the rules
say for whatever legal jurisdictions you are working in. Assuming you do
not like spending time in court.

>
> Thank you,
> Chris


--
Adrian Klaver
adrian.klaver@aklaver.com

If you're storing HIPAA data and/or PII then just make sure it's encrypted at rest. We just did this at my workplace by using full disk encryption on the disk which stores the DB files.
That may not be the best solution, but it appears to work well enough.

data really should be encrypted at the end point it originates and only decrypted at the end point where its used.    yes, this presents all sorts of annoying issues for everything in between, but anything less is false security.

the problem with full disk encryption, as long as the volume is mounted, the data is visible as the encryption keys are loaded at boot or mount time.  the only threat model FDE protects against is physical theft of the server.

-- 
john r pierce, recycling bits in santa cruz