This wiki has undergone a migration to Confluence found Here
<meta name="googlebot" content="noindex">

Difference between revisions of "HL7 FHIR Security 2018-04-03"

From HL7Wiki
Jump to navigation Jump to search
Line 76: Line 76:
  
 
==Minutes==
 
==Minutes==
 +
* John Chaired
 +
* Minutes approved: Kathleen Connor / Nathan Botts: unanimous
 +
* Announcements given
 +
* Note previous new items have a dedicated thread in the Zulip Security and Privacy stream
 +
* Focus on ONC white paper
 +
* Motion: JC/KC - Where secure http communications are needed, include TLS 1.2 or higher as best-practice in the specification, and consider it as a candidate for being a requirement.
 +
** Modify first sentence of second paragraph: "TLS 1.2 or higher SHOULD be used for all production data exchange, and disable support for lower versions of TLS."
 +
** post-paragraph add : "When using TLS use with strong cipher suites (e.g, AES)."
 +
** References: SMART-on-FHIR, NIST SP 800-52, IETF RFC xxxx on HTTP ......
 +
** Action: Matt will provide references used in Sequoia
 +
* New Work
 +
** Input Validation
 +
*** ACTION: John - find in current spec on Input Validation to see if it captures Security need. If so, then add pointer to it from security, if not then we need to build text
 +
*** ONC: Ensure that API cannot be manipulated to unintentionally expose health information or system vulnerability information.
 +
*** Add to top level security punch list: " Disable any messages that may have been used for debugging or error trapping purposes in a development environment to limit the exposure of information that may make an EHR vulnerable to attack."
 +
** Continuous security testing and remediation
 +
*** Using off-the-shelf and open-source tools to simulate attacks, code inspection, and in other ways probe for vulnerabilities, and remediation of those vulnerabilities following Risk-Management methodology.

Revision as of 19:05, 3 April 2018

Call Logistics

Weekly: Tuesday at 02:00 EST 

Web conference desktop and VOIP https://www.freeconferencecall.com/join/security36 
Online Meeting ID: security36
Phone: +1 515-604-9567, Participant Code: 880898
 Please be aware that teleconference meetings are recorded to assist with creating the meeting minutes

Back to HL7 FHIR security topics

Attendees

Member Name Member Name Member Name
x John Moehrke Security Co-Chair x Kathleen Connor Security Co-Chair . Alexander Mense Security Co-chair
x Suzanne Gonzales-Webb CBCC Co-Chair . Mike Davis x Joe Lamy AEGIS
x Ali Massihi . Johnathan Coleman CBCC co-chair x Nathan Botts Mobile co-chair
. Diana Proud-Madruga . Rob Horn . Beth Pumo
. Irina Connelly . Mario Hyland AEGIS . Mark Underwood NIST
. Peter Bachman . Grahame Greve FHIR Program Director x Kevin Shekleton (Cerner, CDS Hooks)
x Luis Maas EMR Direct x Dave Silver x Francisco Jauregui

Agenda

Minutes

  • John Chaired
  • Minutes approved: Kathleen Connor / Nathan Botts: unanimous
  • Announcements given
  • Note previous new items have a dedicated thread in the Zulip Security and Privacy stream
  • Focus on ONC white paper
  • Motion: JC/KC - Where secure http communications are needed, include TLS 1.2 or higher as best-practice in the specification, and consider it as a candidate for being a requirement.
    • Modify first sentence of second paragraph: "TLS 1.2 or higher SHOULD be used for all production data exchange, and disable support for lower versions of TLS."
    • post-paragraph add : "When using TLS use with strong cipher suites (e.g, AES)."
    • References: SMART-on-FHIR, NIST SP 800-52, IETF RFC xxxx on HTTP ......
    • Action: Matt will provide references used in Sequoia
  • New Work
    • Input Validation
      • ACTION: John - find in current spec on Input Validation to see if it captures Security need. If so, then add pointer to it from security, if not then we need to build text
      • ONC: Ensure that API cannot be manipulated to unintentionally expose health information or system vulnerability information.
      • Add to top level security punch list: " Disable any messages that may have been used for debugging or error trapping purposes in a development environment to limit the exposure of information that may make an EHR vulnerable to attack."
    • Continuous security testing and remediation
      • Using off-the-shelf and open-source tools to simulate attacks, code inspection, and in other ways probe for vulnerabilities, and remediation of those vulnerabilities following Risk-Management methodology.
Retrieved from "https://wiki.hl7.org/w/index.php?title=HL7_FHIR_Security_2018-04-03&oldid=155347"