Security audit and vulnerability assessment of FX Hospital EHR/EMR systems

Security Audit for FX Hospital EHR/EMR Systems

The study carries out the security audits for the FX Hospital EHR/EMR information systems to identify the vulnerabilities in the systems. The study uses the BackTrack as an auditing tool to penetrate the website, and outcomes of the auditing reveal that the website is not secure and can be subject to different vulnerabilities. After carrying out the auditing, the study is able to collect as much patients' data as possible revealing the website can be subject to vulnerable attacks. One of the vulnerabilities identified is that the website URL starts from HTTP showing that an attacker can easily break into the website and collect sensitive information. Moreover, all the data in the website are not encrypted making them easy for an attacker to collect patients' data.

By consequence, the FX Hospital can face lawsuits for failing to protect patients' data because if patients' data are stolen by an unauthorized individual and are misused for personal gains, the issue can lead to a lawsuit. The paper suggests different strategies that FX Hospital can employ to protect the website from the vulnerabilities. The study suggests converting the website's URL from HTTP to HTTPS. The HTTPS is a combination of HTTP and SSL (Secure Socket Layer) that offers an effective security protocol for the website. The HTTPS will encrypt all the data in the website, which will consequently protect the data from being stolen by an authorized individual. The paper also suggests using the combination of IDS and IPS and firewall to detect and prevent unauthorized access to the website. The integration of a powerful antivirus is also recommended to protect the website from virus and worms attacks.

Introduction

The IT (information technology) can inherently associated with risks and vulnerabilities based on the poorly configuration of firewalls, and unsecured SQL databases. The vulnerabilities can make organizations to lose enormous amount of revenue if a hacker is able to penetrate the dataset of an organization. In the United States, websites of healthcare organizations can contain sensitive information of patients and employees such as SSN (Social Security Number), credit card information and other sensitive information. If an attacker is able to penetrate an organizational website and collect sensitive information, the organization can lose enormous amount of money from law suits, which can consequently damage business image.

The following healthcare website http://vlab02.pneumann.com/patients13/?bill_month=8&sec=HSPO15 can be vulnerable to attack since it seems that website does not integrate the encryption or cryptographic security protocol to protect it from an unauthorized access. Moreover, the website does not have the firewall to protect it from an unauthorized network intrusion. Additionally, the "IDS (intrusion detection systems) and IPS (intrusion prevention systems)" (Abdel-Aziz,2009, p 10) are not integrated in the system to detect and prevent potential vulnerabilities. Based on the loopholes identified in the system, the study carries out the security audit of the website to uncover the vulnerabilities in the website.

Objective of this project is to carry out the security audit of the website listed below:

http://vlab02.pneumann.com/patients13/?bill_month=8&sec=HSPO15

The outcomes of the audits assist in providing security recommendations for the website

Methodology and Tools to Perform the Security Audit

The "vulnerabilities are software flaws or misconfigurations that cause a weakness in the security of a system. Vulnerabilities can be exploited by a malicious entity to violate policies-for example, to gain greater access or permission that is authorized on a computer." (Mell, Bergeron, & Henning, 2005 p 7).

Security audits are the strategy of identifying vulnerabilities in the website. Wai, (2002) identifies penetrating testing as the effective strategy of identifying vulnerabilities. A penetration test involves attacking a website using a trusted individual. The penetration test can also involve scanning the IP address in order to identify the machines that are vulnerabilities.

The paper uses the BackTrack software to perform the security audit and penetrating testing. The modern website in the contemporary IT environment has faced increasing security challenges because of the security vulnerabilities, and changing of hacker's tactics. Moreover, modern application and websites are extremely complex because business stakeholders are increasingly facing challenges to build a secure website that can be fool proofed to hacking. One of best strategies to build a secured website is to use an ethical hacker to identify the vulnerabilities before a criminal has intruded in the website. Typically, an ethical hacker assists in identifying the vulnerabilities, and suggests the strategies to build a secured website. In this sense, the study explores the vulnerabilities of the website, and the identification of the vulnerabilities assists in designing the strategy to protect the information systems using different methods. The strategy used to practice the ethical hacking of the website is discussed as follows:

The paper uses the BackTrack software to audit the website. The BackTrack is one of the hacking tools that can be used to penetrate the database of websites of different organizations. With the BackTrack tool, a hacker can penetrate the website and collect sensitive information. As being revealed in Fig 1, it is easy to collect data from the website by selecting BackTrack and information gathering from the database of the website.

Fig 1: Information Gathering

After clicking the sqlmap, the screen in the Fig 2 opens.

Fig 2: Open the Sqlmap

After hacking the website, the study has been able to collect different patients' data from the website. The data collected include name of patients, DOB (date of birth), bill month, and balance as being revealed in table 1 .

Table 1 "FX HOSPITAL EHR/EMR SYSTEM"

"Administrative Personnel Only"

MID

DOB

BILL_MONTH

BALANCE

Jim Miller

11

Jim Smith

3

Bob Smith

4

Ryan Ain

3

Jennie Washington

db337433205

2

John Smith

4

Jim Cox

7

Doug Cox

6

Susan Cox

10/11/1992

8

Dean Silver

11

Hunter Smith

9

Chris Bennon

12

Group Five

10/20/2000

10

Group Five

10/20/2015

10

Raul Miller

10

Susan Cox

10/11/1992

8

Steve Ain

3

Group Five

10/20/2015

10

Group Five

10/20/2015

10

Strategies to Secure the Website from the Vulnerabilities

Stallings, (2011) argues that security networks are very critical for an application website. The internet security consists of different measures to prevent unauthorized access to the information systems. An internet security refers to the protection of information systems to attain applicable security that include integrity, confidentiality, and availability of the information resources.

The paper suggests using the SSL (Secure Socket Layer) to provide effective security to the website by integrating the TSL (transport layer service). Typically, a combination of SSL and TLS assists in delivering confidentiality to the website using the symmetric encryption. Moreover, the SSL/TLS is the mechanisms that can enhance effective data security for the patients' data stored in the database. Additionally, it is critical to use the HTTPS to protect an unauthorized access to the data in the website. The HTTPS is the combination of HTTP and SSL to enhance an effective security for the Web browser. Overview of the website reveals that it does not have the combination of HTTP and SSL. http://vlab02.pneumann.com/patients13/?bill_month=8&sec=HSPO15

Essentially, the HTTPS is built in enhancing effective security over the Web browser. The difference between HTTP and HTTPS is that HTTP uses the connection port 80 where the HTTPS uses port 443 that invokes SSL. When the website is converted to HTTPS, it will be possible to encrypt the following information and communication:

Patients' data

URL of the document,

Contents in the document,

Contents of the browser forms,

Cookies transferred from the server to browser and from the browser to server,

Contents of the HTTP header.

The paper also suggests using the SSH (Secure Shell) to protect the website. The SSH protocol assists in enhancing a secured network communication, which is inexpensive and simple to implement. "The SSH provides a more general client/server capability and can be used for such network functions as file transfer and e-mail." (Stallings, 2011, p 508) . The paper also suggests using the TCP (Transport Layer Protocol) to enhance data confidentiality, server authentication, and data integrity.

The study suggests integrating the intrusion detection systems in the website. The intrusion detection systems are an effective security strategy to detect the vulnerabilities in the system. Moreover, there is a need to integrate the intrusion prevention systems to prevent unauthorized access into the network system. Singh (2013) argues that combination of both the IPS and IDS are very effective solutions. The IDS captures packets and respond to threats using signatures to detect malicious traffic. Despite the benefits of the IDS, however, it cannot prevent the traffic from passing through the information systems. Moreover, the IDS cannot prevent the malicious traffic penetrating the system. Thus, the attackers can penetrate a website despite the installation of the IDS. An IDS often requires the assistance of the security devices such as firewall and IPS to respond to an attack. Thus, it is very critical to protect the website by integrating the IPS along the IDS to protect the website. The IPS is an effective security tool that provides protection against malicious attack in a real time. Contrary to the IDS, the IPS prevents packets from entering into the systems. Additionally, the IPS identifies and blocks the attack that would have passed the firewall. Essentially, the IPS and IDS technologies use signatures to detect patterns to detect and prevent intrusion activities.

Cryptographic Standards: The cryptographic standards are the other security protocol to protect the website from an unauthorized data access. The security devices use the ciphertext so that an unauthorized individual will not be able to have access to the data. For example, the Cryptographic Standards will change the data in the website into a nonsense and unreadable data that will not be useful for an attacker. The encryption technology will change the data into non-readable nonsense texts that an individual with decryption key can only have access. In sense, the security strategy will assist in storing and transferring the data in a secured manner. (Stallings, 2011). Moreover, Cryptographic Standards will assist in storing patients sensitive data without fear of being accessed by an unauthorized individual. The study also suggests using the Advanced Encryption Standard that involves using the combination different keys that include 128,192 and 256 key in order to develop 128-bit encryption keys that assist in offering effective security for the patients' data.

Firewall: Firewall technology is another security technology assisting in protecting a website from vulnerabilities. Analysis of the website reveals that the company has not installed an effective firewall prevent an unauthorized network access. The firewall is a security system that prevents the network system from outside network systems. (Chadwick, 2012). The firewall assists in filtering the outside internet traffic from accessing the organizational network systems. Analysis of the website reveals that it does not have not a firewall. An effective integration of firewall will assist in preventing an unauthorized access to the website. (Young, 2008). The paper suggests using the packet filters and network layer firewall to protect the website. The network layer firewalls are the security systems that prevent the packets from passing through the firewall unless they match the established rules. Typically, the website administrator can define the rules of the packet filtering. (Wolfgang, 2011).

Stallings, (2011) identifies the symmetric encryption as a security strategy to protect the website. Typically, symmetric encryption will transform the patients' data plaintext into the ciphertext using an encryption algorithms and secrete key. However, the decryption key will only be used to convert the ciphertext into plaintext. (Osterhage, 2011).

Antivirus: The study suggests using the anti-virus to protect the website from virus and worm attack. The paper suggests using the fourth organization antivirus such as the DIS (Digital Immune System) to protect the website. (Burr, Ferraiolo, & Waltermire, 2014).

"The Digital Immune System provides rapid response time so that viruses can be stamped out almost as soon as they are introduced. When a new virus enters a website, the immune system automatically captures it, analyzes it, adds detection and shielding for it, removes it, and passes information about that virus to systems running IBM Antivirus so that it can be detected before it is allowed to run elsewhere." (Stallings, 2011 p 21-15).

Integrating of antivirus in the website is very essential because the firewall, IPS, IDS and encryption technology are not effective for the worm and virus attacks. Thus, a powerful antivirus in combination with other security tools will offer an effective security for the website. The paper also suggests that the company should design security policy that all employees should follow. Typically, all employee should undergo a short training to improve their knowledge on the strategy to employ in protecting the website .

Conclusion

The study carries out a security audit for the FX website using the BackTrack penetrating tool. The outcomes of the auditing reveal that the website is not secure and can be subject to different vulnerabilities. The website URL is not secure because it starts with HTTP, which does not offer an effective security for the patients data. By consequence, the website can be susceptible to both active and passive attacks. The active attacks involve using a penetrating tool to steal the patients data. The company also face the risk of virus and worm attacks since the internet is not secure. The hospital can lose enormous amount of revenue if an attacker eventually steals the patients information and use it for an unauthorized purpose. The issue can make the organization to face a law suit that can damage the company reputation. The FX Hospital should provide an immediate security for the information systems to protect patients' data.

The paper provides different security protocols to protect the website by recommending using the HTTPS instead of using the HTTP for the URL because the HTTP cannot protect the data in the website. The study also suggests an integration of IDS, IPS and firewall to protect and prevent an unauthorized access to the network system. The paper suggests integrating a powerful antivirus in the network system to protect the website from the virus and worm attacks.

Reference

Abdel-Aziz, A. (2009). Intrusion Detection & Response - Leveraging Next Generation Firewall Technology. SANS Institute.

Burr, W. Ferraiolo, H. & Waltermire, D. (2014). IEEE Computer Society. NIST and Computer Security.

Chadwick, D. (2012). Network Firewall Technologies. IS Institute, University of Salford.

Mell, P.Bergeron, T. & Henning, D.(2005).Creating a Patch and Vulnerability Management Program. National Institute of Standards and Technology (NIST).