Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #14320
| From | "J.O. Aho" <user@example.net> |
|---|---|
| Newsgroups | comp.lang.php |
| Subject | Re: getting started with encryption |
| Date | 2014-10-11 18:38 +0200 |
| Message-ID | <c9t4nvFhpigU1@mid.individual.net> (permalink) |
| References | <m199hi$mh4$1@speranza.aioe.org> <m1bf9k$hv4$1@dont-email.me> <m1bfl8$dka$1@speranza.aioe.org> |
On 11/10/14 16:42, bill wrote: > On 10/11/2014 10:36 AM, Jerry Stuckle wrote: >> If you are in the United States and dealing with patient medical data of >> any kind, you need to understand and follow HIPAA. Having someone HIPAA >> certified is the best. Failure and result in six or seven figure fines. >> >> For instance, all patient data MUST be secured. This doesn't mean just >> encrypting it in the database; it means the data must also be secured >> from any break-in, including physical theft of the system itself. You >> can't, for instance, have the decryption password readable, even if it >> is in a script. You also have to restrict who physically has access to >> the information server. >> >> The Feds are cracking down on HIPAA compliance; it's good you are >> encrypting the data. Just make sure you do it right. >> >> J.O.'s suggestion of doing it at the database level is a good on. > We have addressed physical security and have good access controls, now > we are moving on to worst case stuff - if the server is stolen. Session data stored in persistent storage will give the unauthorized 3rd party all they may need to decrypt the database. A brute force attack will be a lot simpler when just need to figure out a string. > Decryption password will have to be entered at each user login and > disappears when the session ends or when the user is auto loged out > after 3 hours of inactivity. 3 hours inactivity is far too long. Having the encryption/decryption key in memory for that long time will just make it easy to get hold of it for unauthorized 3rp party access. If you haven't, I suggest you take a look at Cornucopia, https://www.owasp.org/index.php/OWASP_Cornucopia quite useful game to figure out what vulnerabilities you may have. This covers more than just the OWASP top 10. -- //Aho
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
getting started with encryption bill <william@TechServSys.com> - 2014-10-10 14:46 -0400
Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-10 16:36 -0400
Re: getting started with encryption John-Paul Stewart <jpstewart@sympatico.ca> - 2014-10-10 18:53 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 09:07 +0200
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 07:59 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 10:36 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 10:42 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 11:45 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 18:38 +0200
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 15:16 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 10:53 +0200
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:17 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 08:47 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:04 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:13 -0400
Re: getting started with encryption "J. Clarke" <jclarkeusenet@cox.net> - 2014-10-12 15:12 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 21:45 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:53 +0200
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 10:07 -0400
How - off topic bill <william@TechServSys.com> - 2014-10-12 11:05 -0400
Re: How - off topic "J.O. Aho" <user@example.net> - 2014-10-12 17:27 +0200
Re: How - off topic Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:23 +0000
Re: How - off topic Tim Streater <timstreater@greenbee.net> - 2014-10-12 18:49 +0100
Re: How - off topic bill <william@TechServSys.com> - 2014-10-13 09:24 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:01 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:19 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:38 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:18 -0400
Re: getting started with encryption - now off topic with gratuitous insults bill <william@TechServSys.com> - 2014-10-13 10:36 -0400
Re: getting started with encryption - now off topic with gratuitous insults Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:14 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:15 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:52 +0200
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:17 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 17:45 +0200
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:58 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:23 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 10:44 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:20 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-15 21:52 +0200
Re: getting started with encryption gordonb.1o7q6@burditt.org (Gordon Burditt) - 2014-10-16 12:13 -0500
Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-16 15:25 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 08:13 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 07:52 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-18 14:46 +0200
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-19 07:47 -0400
Re: getting started with encryption Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:30 +0000
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:59 -0400
csiph-web