Having built a web app based on a PHP stack which is deployed on a server, I would like to have a way to provide access to it offline. There's a database of patients and appointments that needs to be consulted for read access when a connection is down or not available. Access to the web app requires an account login.
The concern is that, given the sensitive nature of the data, both in terms of code and DB, simply deploying the web app locally in its original form is definitely not an option.
I was wondering whether putting together an encrypted VM bundled with the web app and a web server would provide enough security. The client would be prompted for a password, run the VM and connect to the web app using a local address, in the similar way they would for the remote server.
My expectations in terms of security would be that an attacker with access to the local system would not:
- be able to log into the VM
- have access to the actual code of the web app while the VM is running
- have access to the DB data while the VM is running
- can not infer sensitive information via memory dump while VM is running
- even if they copy the image they won't be able to use it without the password
Is this achievable with a VM and how much protection encrypting it provides? From what I've seen, the kind of information vendors are willing to provide, is more in terms of of configuration steps and less in terms of security capabilities.
I was also wondering whether providing a trimmed down version of the web-app as an obfuscated executable client (which I'd have to reimplement from scratch and keep in synch with the actual web app) and an encrypted database would make for a better solution.