Securing OpenEMR - AWS
From OpenEMR Project Wiki
- Please feel free to ask security questions and get very quick feedback on via our chat system
- BY FAR THE MOST IMPORTANT THING YOU CAN DO is enable 2FA for your AWS account
- Setting up 2FA
- Billing Estimates
- Other Account Tasks
Secure Your Domain (Optional - Route53)
- This is a guide for securing your domain if you registered it via AWS's Route53. If you did not, some of the concepts still apply and you are encouraged to implement where ever your domain is registered.
- There are 3 important records for securing a domain: SPF, DKIM, and DMARC.
- The most important is SPF. To implement SPF:
- xyz, xyz xyz
- Implement DKIM:
- Implement DMARC:
Configure Logging (CloudTrail)
Configure Your Network (VPC)
- Flow Logs
- Flow Logs allow you to perform a variety of security and monitoring tasks. Turning them on is simple: [screenshot]
- Security Group rules
- Security Group rules restrict inbound internet access to your system.
- You should have Port 443 open to the broader internet. If you can restrict it to a specific list of IP Addresses, say a few clinics, even better.
- Port 22 should only be open to the specific IP address of the admin who needs to SSH in.
Monitor Cyber Attacks (GuardDuty)
Create a Load Balancer (EC2)
- Application Load Balancer
Set up a Firewall (WAF)