Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #14322
| From | "J.O. Aho" <user@example.net> |
|---|---|
| Newsgroups | comp.lang.php |
| Subject | Re: getting started with encryption |
| Date | 2014-10-12 10:53 +0200 |
| Message-ID | <c9utqmFr7dU1@mid.individual.net> (permalink) |
| References | <m199hi$mh4$1@speranza.aioe.org> <m1bf9k$hv4$1@dont-email.me> <m1bfl8$dka$1@speranza.aioe.org> <c9t4nvFhpigU1@mid.individual.net> <m1bvn7$bjj$1@dont-email.me> |
On 11/10/14 21:16, Jerry Stuckle wrote: > On 10/11/2014 12:38 PM, J.O. Aho wrote: >> On 11/10/14 16:42, bill wrote: >>> On 10/11/2014 10:36 AM, Jerry Stuckle wrote: >>>> If you are in the United States and dealing with patient medical data of >>>> any kind, you need to understand and follow HIPAA. Having someone HIPAA >>>> certified is the best. Failure and result in six or seven figure fines. >>>> >>>> For instance, all patient data MUST be secured. This doesn't mean just >>>> encrypting it in the database; it means the data must also be secured >>>> from any break-in, including physical theft of the system itself. You >>>> can't, for instance, have the decryption password readable, even if it >>>> is in a script. You also have to restrict who physically has access to >>>> the information server. >>>> >>>> The Feds are cracking down on HIPAA compliance; it's good you are >>>> encrypting the data. Just make sure you do it right. >>>> >>>> J.O.'s suggestion of doing it at the database level is a good on. >>> We have addressed physical security and have good access controls, now >>> we are moving on to worst case stuff - if the server is stolen. >> >> Session data stored in persistent storage will give the unauthorized 3rd >> party all they may need to decrypt the database. A brute force attack >> will be a lot simpler when just need to figure out a string. >> >> >>> Decryption password will have to be entered at each user login and >>> disappears when the session ends or when the user is auto loged out >>> after 3 hours of inactivity. >> >> 3 hours inactivity is far too long. >> >> Having the encryption/decryption key in memory for that long time will >> just make it easy to get hold of it for unauthorized 3rp party access. >> > > Very definitely. I can see all kinds of holes in their system. He is > leaving them wide open to a HIPAA fine. I just pity his customer, who will suffer quite a lot of this and it seems they have not got the best service, a lot of to place elements, meta refresh to redirect to the new wordpress page (looks cheap when you get to see the old page before the wordpress page loads, which seems to have some misconfiguration). >> If you haven't, I suggest you take a look at Cornucopia, >> https://www.owasp.org/index.php/OWASP_Cornucopia >> >> quite useful game to figure out what vulnerabilities you may have. This >> covers more than just the OWASP top 10. >> > I hadn't seen this one before, J.O. Looks like an interesting game. It's somewhat new for me, got a on cards printed deck from the London chapter leader Justin Clarke, really nice guy. We test played it on a fictive project, and sure you start to think how things can go wrong. The recommended group size is 4 people from different backgrounds, like Developer, CSO, Business. -- //Aho
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
getting started with encryption bill <william@TechServSys.com> - 2014-10-10 14:46 -0400
Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-10 16:36 -0400
Re: getting started with encryption John-Paul Stewart <jpstewart@sympatico.ca> - 2014-10-10 18:53 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 09:07 +0200
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 07:59 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 10:36 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 10:42 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 11:45 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 18:38 +0200
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 15:16 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 10:53 +0200
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:17 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 08:47 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:04 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:13 -0400
Re: getting started with encryption "J. Clarke" <jclarkeusenet@cox.net> - 2014-10-12 15:12 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 21:45 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:53 +0200
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 10:07 -0400
How - off topic bill <william@TechServSys.com> - 2014-10-12 11:05 -0400
Re: How - off topic "J.O. Aho" <user@example.net> - 2014-10-12 17:27 +0200
Re: How - off topic Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:23 +0000
Re: How - off topic Tim Streater <timstreater@greenbee.net> - 2014-10-12 18:49 +0100
Re: How - off topic bill <william@TechServSys.com> - 2014-10-13 09:24 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:01 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:19 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:38 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:18 -0400
Re: getting started with encryption - now off topic with gratuitous insults bill <william@TechServSys.com> - 2014-10-13 10:36 -0400
Re: getting started with encryption - now off topic with gratuitous insults Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:14 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:15 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:52 +0200
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:17 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 17:45 +0200
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:58 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:23 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 10:44 -0400
Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:20 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-15 21:52 +0200
Re: getting started with encryption gordonb.1o7q6@burditt.org (Gordon Burditt) - 2014-10-16 12:13 -0500
Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-16 15:25 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 08:13 -0400
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 07:52 -0400
Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-18 14:46 +0200
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-19 07:47 -0400
Re: getting started with encryption Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:30 +0000
Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:59 -0400
csiph-web