[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Gnumed-devel] GNUmed (debian) servers and security
From: |
Dave Cramer |
Subject: |
Re: [Gnumed-devel] GNUmed (debian) servers and security |
Date: |
Mon, 28 Jan 2008 22:28:44 -0500 |
On 28-Jan-08, at 9:56 PM, James Busser wrote:
On 28-Jan-08, at 8:24 AM, Dave Cramer wrote:
That being said, I'd simply use a dedicated network connection
between the two machines that could not be sniffed.
Connecting from a remote private machine *over which you have
control* can be done using a ($$$) dedicated network connection, or
a VPN like openVPN.
Connecting from a remote machine *over which you have less (or no)
control* is the problem.
Ah, now I get it!. Interesting argument for a web client.
Many doctors have a need to connect to their EMR from inside the
hospital. Even the doctors who let others look after their patients
when in hospital, in many cases, still visit the patients at least
in special cases or may be at the hospital for other reasons. It
would not be unusual for at least some GPs to spend 30 or more
minutes per day at a hospital at least a couple of times per week
(in some cases they might spend a full morning or afternoon) and the
inability to connect to their EMR from inside the hospital is not
going to be acceptable.
Some hospitals might soon provide enough wireless access that a
doctor with their own laptop might be able to set up a VPN, but the
majority I am sure will find ports and VPNs blocked. So I think that
doctors who could have a copy of GNUmed on a hospital machine (or
USB stick) still have to be able to connect via ports 80 or 443
without a VPN.
openVPN is quite adept at using port 80 or port 443. It can be setup
to share port 80 or 443 with a web server.
For the purpose of a doctor accessing a single patient (or small
number of patients' EMR) it is acceptable to let the hospital proxy
decrypt and re-encrypt the doctor's SSL traffic to their GNUmed EMR.
I think it is important to prevent man-in-the-middle attacks on the
connection between the hospital and the GNUmed server so unless the
hospital offered some tunnel to this server then the SSL would be
needed unless people figure some other way for a secure connection
I've also kicked around the notion of a REST server for an EMR which
would remove the direct database connection.
Dave
- Re: [Gnumed-devel] Re: GNUmed (debian) servers and security, (continued)
Re: [Gnumed-devel] GNUmed (debian) servers and security, Karsten Hilbert, 2008/01/28
Re: [Gnumed-devel] GNUmed (debian) servers and security, Dave Cramer, 2008/01/28