System, Network, Backups and Disaster Recovery

Contents

  • Data Security (DLP, SEIM, and Access Management)

  • More about DLP

  • Alerting examples

  • What redundancy and availability does the data center provide?

  • RTO / RPO times

  • How is ER Express' production network is segmented from its corporate, QA, and development environments?

  • What happens to client data after it has been backed up?

  • Failover Testing
  • RPO Testing

 

Data Security (DLP, SEIM, and Access Management)

How do you protect user authentication information?

ER Express employs a combination of DLP, SEIM, and Access Management

  • For Data Loss Prevent (DLP), we protect endpoints by encrypting hard drives, protect against malware, monitor networks for data in motion, and properly classify and protect data at rests.
  • For Security Information and event management (SEIM) we log all login attempts (successful and unsuccessful) and maintain intrusion detection software to identify unusual events. All events follow an escalation path that includes reaching the VP of Product and CEO.
  • For access management, all users are assigned a role with role-based privileges pre-defined access levels.

More about DLP

  • The database server where client data will be stored is encrypted and all backup copies are encrypted on the storage media.
  • The data is encrypted using AES/128 bit in a SQL database.
  • To gain access to a database server containing client data, the calling application must provide a valid and unique username/password combination to ensure that all data requests to the database server are handled by internal authentication mechanisms.
  • Access to the database server data is accessed only through pre-defined view to prevent users from directly accessing the data tables.

More about SEIM:

ER Express has the following capabilities:

  • Data aggregation to log monitored data
  • Alerting to notify ER Express staff about immediate issues via email.
  • Dashboards that ER Express staff can view flagged issues.
  • Compliance: logs of key activities such as failed login attempts, all user actions in the system, etc.
  • Retention: long-term storage of log data.
  • Forensic analysis: the ability to search across different logs.

Alerting examples include:

  • Repeat attack login source to detect brute force attacks / password guessing: Alert on three or more failed logins in a single minute from a single host
  • Repeat attack firewall to detect for scans / worm propagation: Alert on 15 or more Firewall Drop/Reject/Deny Events from a single IP Address in one minute.
  • Repeat Attack-Network Intrusion Prevention System to detect for scans / worm propagation: Alert on 7 or more IDS Alerts from a single IP Address in one minute
  • Repeat Attack-Host Intrusion Prevention System to detect Find hosts that may be infected or compromised (exhibiting infection behaviors): Alert on 3 or more events from a single IP Address in 10 minutes
  • Virus Detection/Removal: Alert when a virus, spyware or other malware is detected on a host: Alert when a single host sees an identifiable piece of malware
  • Virus or Spyware Detected but Failed to Clean: Alert when >1 Hour has passed since malware was detected, on a source, with no corresponding virus successfully removed: Alert when a single host fails to auto-clean malware within 1 hour of detection

Based on the list developed by David Swift of the SANS Institute
Source: https://en.wikipedia.org/wiki/Security_information_and_event_management

 

What versions of database(s) do you run?

ER Express uses a Microsoft SQL Azure (RTM) 12.0

 

How is ER Express' production network is segmented from its corporate, QA, and development environments?

We have segmented the environments that handle our customers' data:

  • The production environment is segmented into a separate server with a unique IP address.
  • The QA environment is segmented into a separate server with a unique IP address.
  • The developer environments are built into the ER Express IDE (integrated development environment), Azure DevOps.
  • User access to the production environment needs its own set of credentials which is independent of QA and Development. Credentials are unique to each of the environments

Our corporate computing environment is completely separate from where we host, store and process customer data.

  • ER Express uses a completely separate system for corporate computing.
  • The company uses the Microsoft Office 365 suite, including OneDrive for corporate computing.
  • We have desktop and laptop antivirus.
  • All laptops have boot-level security (using BitLocker) with a pre-boot up PIN separate from the login PIN, hard drive encryption.

 

What redundancy and availability does the data center provide? Describe your data backup and recovery process? (also known as contingency plans or contingency planning)

  • ER Express and its data center have disaster recovery plans that include application monitoring, full system backup, and key business processes with agreed backup strategies.
  • ER Express provides a 99.9% uptime assurance.
  • Our disaster recovery plan is available for download here: Documents & Certificates

 

RTO / RPO times

  • Real-time replication of source code and data:
    • RTO < 60 sec
    • RPO < 30 sec
  • Daily back-up or database, protecting against the corruption of server:
    • RTO < 60 min
    • RPO 2am previous morning
  • Nightly file-level back-up: < 2 hours / < 72 hours
  • Weekly file-level back-up: < 2 hours / < 72 hours
  • Monthly file-level back-up: < 2 hours / < 72 hours

What happens to client data after it has been backed up?

  • ER Express stores and retains the data based on the criteria in the Business Associate Agreement (BAA) that it has with each health system.
  • See 1c. HIPAA – Data Retention Schedule for more detail about how we retain data here: Documents & Certificates

 

Has ER Express Tested its Failover process?

Yes.  Here is a screenshot from the most recent failover test:

mceclip0.png

 

Has ER Express tested its RPO process?

Yes.  Screenshot from its most recent RPO test:

mceclip1.png

Have far back can ER Express go to recover data?  Have you tested the recovery process?

ER Express can go back at least 34 days to recover data.  Yes, we have tested the recovery - here is a screenshot from a test:

mceclip2.png

Have more questions? Submit a request