Having built a web app based on a PHP stack which is deployed on a server, I would like to have a way to provide access to it offline. There's a database of patients and appointments that needs to be consulted for read access when a connection is down or not available. Access to the web app requires an account login.

The concern is that, given the sensitive nature of the data, both in terms of code and DB, simply deploying the web app locally in its original form is definitely not an option.

I was wondering whether putting together an encrypted VM bundled with the web app and a web server would provide enough security. The client would be prompted for a password, run the VM and connect to the web app using a local address, in the similar way they would for the remote server.

My expectations in terms of security would be that an attacker with access to the local system would not:

  1. be able to log into the VM
  2. have access to the actual code of the web app while the VM is running
  3. have access to the DB data while the VM is running
  4. can not infer sensitive information via memory dump while VM is running
  5. even if they copy the image they won't be able to use it without the password

Is this achievable with a VM and how much protection encrypting it provides? From what I've seen, the kind of information vendors are willing to provide, is more in terms of of configuration steps and less in terms of security capabilities.

I was also wondering whether providing a trimmed down version of the web-app as an obfuscated executable client (which I'd have to reimplement from scratch and keep in synch with the actual web app) and an encrypted database would make for a better solution.

  • What laws are there regarding the protection of patient data? The way I see it is that you're looking for a way to over come issues within the application. I personally think it's better address possible security flaws and deal with the real problem than "solving issues" from the client-side. – Jeroen Nov 2 '15 at 10:53
  • 2
    In addition to my previous remark, I suggest having someone (a known security company) perform a security assessment on this product. If data gets stolen from your application, most likely you will be held responsible. – Jeroen Nov 2 '15 at 10:55

Depends on the virtualisation platform, but pretty much all bets are off if an attacker gets access to the VM whilst it is running. Assuming they can reboot without needing to enter a password, they can gain single user access and grab whatever data they want at that point.

Similarly, you have no control over the system that is used to run the image - if it dumps memory to disk, the data will get dumped. A sufficiently motivated attacker could write a compatible virtualisation system which has this behaviour.

Ideally, you don't want to store full data locally at all. A better solution, although obviously costlier, might be to look at redundant connections to this system, since it's clearly critical to the practice. Alternatively, it might be possible to run a local server with a copy of the data - this has many of the same issues as a virtualised appliance, but can probably be monitored for tampering more easily, and stored in a physically protected location making physical access more difficult. This server would otherwise need to be treated in the same way as the main application server, receiving patches and being properly firewalled - it would effectively be a mirror of the main server. This should only be considered if there is sufficient technical expertise in running high risk systems though.

| improve this answer | |

@matthew already talked about the drawbacks of using a VM for this. I want to add that for such an application I would use a web service, if budget is an issue you can store the front end in a Raspberry Pi or Arduino board which are very cheap. The idea is that the front end is always rendered but the information requires a server side connection, or using web workers you can set up a queue that will process the tasks when a connection is re-established. This could be deployed as a Chrome App or similar, these types of apps are meant for "offline first" access, as stated in their "Develop in the Cloud" chapter. The main point is that the presentation layer does not need to be bound to the network layer. This chapter ("Offline First") has some very good points about security.

Security concerns in this case are related to encryption, I would also consider using temporary tokens for encryption so even if a task is retrieved from the front end before it is sent and purged, the salt used to hash it would be different from another task.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.