4

Some quick background. We are a small company (13 employees, 6 of which or IT/developers). Everyone works remotely and there is no central office. Our datacenter is only used for development and production environments. We do not use it for any internal company functions (eg. only IT has VPN access to it currently and we use things like Office365/OneDrive rather than a file server on our network) We develop, host, and sell a SaaS solution. We deal a bit with medical data (eg. HIPAA and PHI) so we have gone through the process of getting HIPAA and NIST certified which is very important to our customers.

Current Infrastructure

We have a half rack at a datacenter with clustered Hyper-V environment (3 physical servers connected to a Nimble SAN). Our environment consists of:

  1. pfSense perimeter firewall (OpenVPN configured as well as Snort for IDS/IPS)
  2. Redundant HAProxy using keepalived with SSL termination
  3. Two Windows 2008R2 VMs running IIS for our main application (Note: currently using Cloudflare Business which has a WAF)
  4. Two Windows 2012R2 VMs running SQL 2014 in an active/passive failover cluster.
  5. We also have a separate Dev VM, 2 AD VMs, and a DPM VM for backups but I am not really concerned about those for this post - just wanted to mention they exist

We already use Azure storage for housing client documents as well as offsite backups. We also have a cold DR site configured in Azure consisting of three VMs (AD, Web, and DB) that, while minimal, would allow us to spin up our main infrastructure on Azure within a couple of hours.

Plan Forward

Our goal (ideally by the end of 2019) is to move out of the datacenter and into Azure. Our current hardware is aging and while showing no signs of failure (knock on wood), we want to get out of the datacenter arena of having to worry about physical equipment when a company like Microsoft (or Amazon/Google/etc) is far more capable of doing so. I have a decent idea in my head on how to make this work and have been playing with Azure over the last month to familiarize myself with the options.

From a high level standpoint, I am looking at something as simple as this deployment (https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/basic-web-app) for our application. We considered a lift and shift approach of recreating our existing VMs directly in Azure but moving to PaaS is much more appealing from a maintenance standpoint. The main difference would be that we would be using the SQL Managed Instance for our database instead of a SQL Database. This architecture would be for our production environment only. For our development/QA environment, we would most likely deploy the same or a similar architecture in a separate Resource Group and vNet.

My biggest questions revolve around how/if a firewall fits in here. We get IT questionnaires and have to go through a full IT security audit with most of our clients. Here are a sample of the questions we get:

  • Are firewalls in use for all internal connections?
  • Are firewalls in use for all external connections?
  • Are firewalls used to segment internal networks?
  • Does the organization employ an intrusion detection (IDS) or intrusion prevention (IPS) system?

In basically all of the examples I have found so far, the recommended Azure deployments do not include anything firewall or IDS/IPS related. Is this pretty standard? I know that Azure Firewall exists but at $900/month it doesn't see worth it for the limited protection it provides on top of NSGs. I have started to look at the option of NVA (specially the Netgate pfSense one because I am very familiar with pfSense) but I don't know if that is going to be overkill?

So, if you are still reading after the long winded plan, I guess what I am asking is:

  1. Does it at least seem like I am on the right path forward? Or am I way off base?
  2. If we were to go forward with a deployment like mentioned above, how would you handle questions from clients regarding firewall and IDS/IPS?
KevinN
  • 41
  • 2

1 Answers1

2

Security and compliance requirements with protected personally identifiable information (PII) is different than in less regulated industries. (And especially compared to beginner tutorials with minimal security design.) In addition to a breach betraying patient trust with very personal information, some jurisdictions impose penalties. In the USA, people tend to cite the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its rules on protected health information (PHI). Penalties can be assessed per record affected, and are worse if caused by neglect.

Firewall questions can start a conversation about your security controls. But they are not a complete security program.

Of course layer 4 firewalls should be in place to control by IP (in Azure, Application Security Group) and port. Also consider segmenting the network. There should be only authorized access to databases that contain PHI, and isolate test from production. Concepts of zero trust may be useful as inspiration. Have a way to prove the firewall rules implement your intent.

You also need ways to prevent and detect breaches. Say you have an API that is unthrottled and unaudited. Network level firewalls do not help when data is sucked out port 443 which is open by design for authorized use.

Controls you can put on this include strong auditing capability in your application, and possibly IDS/IPS to inspect for bad behavior. The question is not just whether Azure Firewall is for you, it how quickly can you show evidence of unauthorized access, how much data was exfiltrated, and who did it. If neither your applications nor Azure does this, consider third party products.

Oh, and email. How are you going to prevent users from sending patient IDs via email?

Physical security for datacenter is taken care of by Azure. But do you enforce disk encryption for employee laptops? Those could get lost with PHI on them.

All this and more calls for a security program with a comprehensive risk management plan, strong processes that don't forget the basics, and leadership involvement. As an example of this defense in depth approach, have a look at SecurityMetric's Guide to HIPAA Compliance.

Be honest with your clients and auditors. Admitting any gaps and offering alternative controls is more believable than claiming to do everything.

John Mahowald
  • 30,009
  • 1
  • 17
  • 32