Healthcare Data Security Checklist

Manage Operating System Strategy 

• Automated Hardening / secure configuration, self-healing. Manage OS Strategy is an automated system that provides hardening and secure configuration of operating systems, ensuring they are kept up-to-date, patched and hardened to their optimum level.
• Patch management of applications and libraries of the operating system. Patch Management is a program for updating the software distribution on your computer. The patch can fix problems or improve performance.
• Creating secure accounts. Create secure accounts with required privileges only (i.e., user management) to access the resources and perform respective duties.

Logging and Monitoring

• Resource monitoring. Resource monitoring is the process of monitoring the use of resources. It involves measuring and storing data about resource usage and further opens up opportunities for performance optimization.
• System and Application logs monitoring. Logs monitoring enables you to monitor, visualize and alert on any log data. It has a powerful search function and supports JSON-formatted logs, making it simple to monitor application logs for security breaches like SQL injection attacks or unusual activities.
• Automated security information. It is a platform that connects you to security experts who are able to detect vulnerabilities in your app and help secure your application.
• Role-based access control in Monitoring tools is a concept of configuring a system so that user roles determine the permissions that a user has to perform certain operations. Implementing role-based access control in monitoring tools increases the security of the monitoring system.

CI/CD Toolkit

• Authorized login. Authorized login allows users to log in with security. Role-Based Access Control for a user to give only project-specific access to the user.
• Developers have limited access. Developers do not have access to real data but only logs to understand the system.
• Only Admin can create a user. New users are only added by the admin and access is defined for each user.
• Prevent home directory access. No build runs on the master node to prevent programs from accessing the Jenkins Home directory and other server files.
• Use Docker containers as Linux agents(nodes). By using Docker containers as Linux agents, you can easily monitor the performance of your applications and keep them up-to-date. For example, an application could be monitored by running a specific command in its Docker container.
• Use Credentials to store and mask sensitive data such as tokens or API keys. Credentials are a portable and secure way to store sensitive data such as tokens or API keys. It works even when the entire system is compromised, keeping your data safe from intruders.
• Managed Jenkins pipeline. Each environment has IAM users (with required access only) for accessing the AWS resources during the execution.
• Additional security measures were implemented in Jenkins. Only whitelisted IP addresses can connect to the Jenkins server using ssh.
• Clean workspace directory(source code) as soon as build finishes. It is a very simple bash script that runs every time after an ant build finishes. It checks for all the directories starting with “workspace” and deletes them.
• Update Jenkins and plugins regularly. Jenkins is an open-source automation server. It is a continuous integration tool that can be used to build, test, and deploy any software project continuously.

SCM Platforms

These are some of the Security configurations for GitHub. GitHub is a web-based Git repository hosting service. It offers all of the distributed version control and source code management (SCM) functionality of Git and adds its own features.

• Only the account owner can create and delete the Repository. All the new repositories shall have an owner. The owner is responsible for adding members to the repository, modifying their permissions and setting up or deleting the permissions for other actions (e.g., pushing to a repository). 
• Only the project manager has admin permission for repositories. A repository is the main unit of information stored in your Github account. It holds all your project-related information, and you can create an unlimited number of repositories.
• Only the Project manager/lead should have written access to main branches. The product should be clean, understandable and simple. Merging new code should only happen after the approval of the project manager.
• The Master branch has only the production code. The master branch is the main branch of a git repository, from where all future changes will be deployed. It is also known as the production branch in the software industry.
• Delete protection for main branches. Delete protection for *main branches* prevents deletion of the branch by non-admin users. When enabled, the branch will require a confirmation from an administrator to be deleted. This is especially useful in organizations that want to enforce some control over the release management process.
• No secrets or environment files will be pushed to the repository. We never store any secrets or environment files in the repository. All credentials and other sensitive information are stored in secure config vaults.
• Only Developers working on the project will have access to the repository. Even though you are the owner of the project, you will not be able to access your repository. This is because the repository is owned by the organization that owns the project and not you.
• Require two-step authentication for every bitbucket/GitHub user account. It is a security feature that will prevent unauthorized access to your account in case the password has been compromised.
• Use ssh keys to access remote git repositories. Git is a free and open-source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
• “Static analysis tools detect Code-smells, Bugs, and Vulnerabilities. Use CodeGrip or similar tool to scan repository code, generate reports, and notify over slack.”
• Update git periodically to keep safe from vulnerabilities. To keep your git repository safe from vulnerabilities, you need to update your project on a regular basis.

Source Code

To keep source code flawless and void of any errors, the following guidelines may help

• Follow OWASP Secure Coding Practices(Automated scan tool like Codegrip can scan this)
• Treat each activity as an event and log each event that happens.
• Strictly avoid the use of credentials in source code. AWS access key and secret key etc should be used.  There are tools that automate the process of reversing source code to extract credentials and other sensitive information from the application. A good example is a tool called AWS-CLI Enumerator. Hence by avoiding to put credentials, one can proactively safeguard against such happening.
• Use secure and updated IDEs and plugins. An IDE or integrated development environment is a software application that provides comprehensive facilities to computer programmers for software development. An IDE normally consists of a source code editor, build automation tools and a debugger. Using up to date versions makes sure that any known flaw is already fixed by the IDE team
• Use static analysis security testing tools(SAST) like CodeGrip. An Automated Code review tool gives detailed code quality reports. This way you can fix bugs, errors, coding standards etc before code goes into production
• Code Review for each Pull Request so that any code that is added to the main branch is already tested
• Dependency-Check to identify any known vulnerable components