OpenMRS Security Assessment 3B

Latest revision as of 11:09, 8 September 2018

Background

OpenMRS is an open-source medical record management system. It is very popular in some parts of the world, but requires work to make it compatible with Department of Health and Human Services regulations authorized by the Health Insurance Portability and Accountability Act (HIPAA). This series of assignments aims to identify specific changes that are required to achieve HIPAA compliance to use OpenMRS in the context of a small medical practice or hospital. (Larger medical practices and hospitals typically have more complex situations and unique risks that require them to conduct their own assessment.)

In this assignment, teams will explore in the source code for the component of OpenMRS they will evaluate and interact with an OpenMRS installation to get a feel for how their component works.

Directions

This project is a large, team-based project with several parts.

The assignment requires you to conduct a risk assessment of OpenMRS and post your assessment on the Security Assessment Wiki.

You can get to your project Wiki pages from OpenMRS Security Assessment Wiki Template. The assignments are described in template pages, starting with OpenMRS Security Assessment Wiki Assessment Template A due .... Click the "edit" option at the top of the template page, copy all of the text of the template and paste it into your team's Wiki page. Then, follow the directions in the template:

1. Describe the part of the OpenMRS Security Assessment that was assigned to your team.
2. Explore the part of OpenMRS that you have been assigned. You should look through the source code for your part of the project in the GitHub repository and you should try using the application at http://local.edu:port/openmrs. Two students have been designated to assist you with any trouble accessing the application or its source code. You can also ask for help at http://talk.openmrs.org.

The template describes various ways to earn points for this assignment. You should earn at least 10 points during this phase.

Deliverables

Teams create a Wiki page and add a description of their project and discussion of the challenges they faced installing the OpenMRS project.

Assessment

The instructor will grade the report after the full assessment is completed.

The instructor should look over the work of each team and provide feedback that will help the team improve their security assessment skills and the remaining portions of the assessment.

The instructor should provide time in the classroom to discuss the assessment as it progresses.

Comments

Allocate time in lecture before this assignment to select the teams. The overall assessment is broken down into 9 parts, with one team assigned to each part. Ideally, you want 3–5 students per team, so this break down of the assessment is appropriate for classes of 15–45 students. For smaller classes, you should reduce the number of options you make available to the students. For larger classes, you should consider conducting a security assessment of some additional modules. You can consult with the OpenMRS community to find out what modules would be the most valuable to assess.

Write up the assessment areas on the board, in a 3 by 3 grid. Leave room to add names with each project. Across the top:

1. Database: Explain that this assessment will focus on the MySQL database. Students who work on this part of the project will learn a great deal about database security. They will also learn how MySQL interacts with the operating system, because a great deal of database security vulnerabilities happen outside the database proper.
2. API layer: The API layer is a Java application that provides the core business logic of OpenMRS. As such, it is responsible to provide complete mediation to the data, and is critical for security. Teams working in this layer will learn about security in enterprise Java applications.
3. WebApp layer: The Webapp is a default implementation, providing a working user interface that uses the API layer to make a useful Patient Record Management System. Far from being a cheesy demo app, this is a robust user interface that is used by nearly all OpenMRS installations. Teams working in this layer will learn about security in Web applications.

Along one side, add the focus areas for assessment.

1. Authentication and Access Control. This focuses on how the layer under investigation manages authentication and authorization. The students working on this aspect should examine the access control protecting each asset in their assigned layer. They should make sure that the access control mechanisms are adequate to provide protection of the assets, that they are consistently applied and that there is no way to access the assets (including reading, modifying, deleting, moving or renaming and obstructing access) without successful access control.
2. Audit. This focuses on how the layer under investigation manages auditing of access to the assets. Auditing is often neglected, but is critical in security generally and especially or HIPAA compliance. Advise students that auditing is weak to nonexistent in OpenMRS, so students selecting this aspect should expect to make recommendation on what kinds of auditing would be appropriate to add to the project. Audit systems make records of events that could end up being significant for security. In a typical audit system, these events relate to the state of the system (e.g. when it is started up or shut down), authentication events (who logs on and who logs off or is otherwise disconnected) and data modification events. In a HIPAA setting, the audit system also needs to record reading and transmitting PHI. A typical audit trail entry records the familiar who-what-when-where-why information about the event.
3. Confidentiality. Unlike the other two aspects (access control and audit), this steps back from the technology and mechanics of security to take a direct look at the human goal of HIPAA, protecting patient privacy. Students should look at the system from the point of view of making sure access to PHI is not just authorized, but is respectful of patient privacy.

After discussing the format of the grid, invite students to come forward and sign up for which part of the project they want to work on. Work with the students to get teams of 3–5 students on each focus area. When I fielded this assignment, it really helped to have enough people, especially when struggling to get OpenMRS set up so they could do the assessment. On the other hand, it is fine if you do not have teams working on some of the focal areas.

While students are working on the project, a large number of issues are likely to come up. OpenMRS is much more complicated than anything the students have installed before, and it will stretch even an experienced system administrator's skills. Encourage the students to plan plenty of time trying to get it set up, but also help them to relax. While it is best to have their own OpenMRS install for the assessment so they can run it in a debugger, etc, plenty of my teams had great success just looking over the source code or using the demo installation hosted on the OpenMRS web site.

In the most recent offering of this assignment, I had one team of students work on developing a prototype auditing system for OpenMRS. Contact the author of this page if you are interested in learning more about this possibility.

Additional Information:

Suggestions for Open Source Community:

• Suggestions for an open source community member who is working in conjunction with the instructor.