Students in my Computer Security course assessed the security of OpenMRS as a class project. I have compiled the results into a report. I have attached it to this post. What is the best way to contribute this report to OpenMRS?
For your convenience, I have included the executive summary of the report below. The full report is nearly 200 pages long, currently available in Word format or PDF, or I can convert it to a WIKI format.
I am also happy to discuss any of the results.
– Dr. Steven P. Crain Assistant Professor Plattsburgh State University of New York Computer Science
Executive Summary
Students at Plattsburgh State University of New York conducted security assessments of OpenMRS during May 2015 and May 2016. Based on the assessments, we recommend specific improvements related to authentication, auditing and documentation.
Our assessment was based on HIPAA regulations, which provide important guidance with respect to the security of health information. HIPAA regulations would be directly applicable if OpenMRS were used in the United States. The students assessed the OpenMRS Core API, database and reference application with attention to access control, accountability and privacy. This assessment followed a well-documented procedure, and can be used as a baseline for regular repeated assessments.
One way that security professionals assess security is using the “CIA triad.” We found that OpenMRS is weak at protecting confidentiality, because, once users log in, they can access any protected health information without restriction and without leaving an audit trail. On the other hand, OpenMRS ensures that only authorized users make changes in the data and generally keeps track of significant changes (integrity). The students did not assess availability, as that is not a major concern in the HIPAA regulations.
Another way that security professionals organize assessment is using the “AAA triad.” OpenMRS has solid authentication and authorization support, but has inadequate support for accountability.
We also measured OpenMRS against commonly used design principles. We found that the overall architecture of OpenMRS was very conducive to security and that OpenMRS has done well at balancing security and usability. However, OpenMRS has some major security concerns. The default admin password violates the principle of fail-safe defaults. Also, there is no support for separating administrative privileges to different users.
From our findings, we determined the most important security changes for OpenMRS. Most importantly, the default admin password should be corrected by implementing a password expiration or password quality policy. Additionally, OpenMRS should implement session timeouts and account locking with repeated login failures. Although more difficult to implement, we provided some feature recommendations for a much-needed auditing system. Further, we recommended a section providing security guidance in the implementers’ documentation. Finally, changes should be made so that administrative responsibilities can be divided across multiple administrators. We believe that these recommendations will make a meaningful difference in the security of OpenMRS implementations.
OpenMRS HIPAA Assessment.pdf (1.7 MB)