Security Module v2.0. White Paper. April 2011

Transcription

1 Security Module v2.0 White Paper April 2011

2 Security Module: Comprehensive Security for CareFusion Products Overview CareFusion offers a comprehensive security technology solution for products running Microsoft Windows 2000 operating system or greater. Security Module is a complementary software offering that incorporates advanced security patch update mechanisms, virus protection tools, local reporting, and secure remote access through CareFusion Remote Support Services, which allows CareFusion to diagnose and potentially resolve security issues remotely. Features of Security Module v2.0 include: Industry-standard patch management using Microsoft Windows Server Update Services (WSUS v3.0 SP2). Virus protection with Symantec Endpoint Protection (SEP). Manage automatic updates of virus definitions for CareFusion products leveraging SEP v11.0. Rapid patch deployment through CareFusion Enterprise Security Services, allowing patches to be quickly and securely deployed to end devices upon certification. End-user Reports provide ability to view patch deployment status, compliance, and exception management. Deployment options allow Security Module v2.0 software to be deployed on customer-owned VMware infrastructure or on customer hardware that meets the minimum specification. Domain and Active Directory integration allow customer IT to effectively manage Security Module services. Secure Connectivity through CareFusion Remote Support Services. Benefits of Security Module v2.0 include: Improving patch deployment efficiency through simplification and automation of key aspects of the patch management process. With Security Module v2.0, manual patch distribution to each device is eliminated because patches are now automatically deployed through connectivity to CareFusion Enterprise Security Services. Promoting a timely, reliable, and consistent patch management solution across singleor multi-facility hospital environments. Local reporting capabilities provide easy access to critical compliance information. Security Module v2.0 provides extensive reporting capabilities that provide IT/Security personnel with the information necessary for adherence to security policies and HIPAA regulations that require a safeguard against security threats. CareFusion Page 2 of 6 April 4, 2011

3 Architecture The following figure shows the Security Module in relation to CareFusion services and devices. Relation of Security Module to CareFusion services and devices Windows Server Update Services (WSUS) 1. Every month, a list of approved patches is generated by CareFusion. This list is distributed to the field and can be communicated to customers who want to be notified of patches that have been released. 2. Approved patch metadata are deployed onto the CareFusion Enterprise Security Services servers. 3. On a predetermined schedule, Security Module servers located within the hospital firewall (local) request updates from the Enterprise servers. If new metadata exist, the data are downloaded to the local server. 4. Upon successful receipt, the local server requests the approved patches from the Microsoft Windows Update Services. 5. Upon successful download of the patches, the local server establishes connectivity to appropriate devices (for example, Pyxis MedStation system, Pyxis SupplyStation CareFusion Page 3 of 6 April 4, 2011

4 system, Pyxis Procar, and so on) and, based on the device settings, automatically deploys the appropriate patches and reboots the device (if required). NOTE: Because this release introduces automated patch delivery, it is critical that device configurations are agreed upon by the customer before installing Security Module v2.0. Symantec Endpoint Protection The Symantec Endpoint Protection (SEP) component of the Security Module is a completely automated process that does not require field or customer involvement. The Security Module server checks with Symantec LiveUpdate server every 4 hours for updated virus definitions. Clients are monitored by an AutoProtect system that checks every file as it is accessed, and clients are also configured to receive a full system scan once a week. If the facility uses a SEP Server, adding approved CareFusion products to the client s server in order to receive the updated definition files can be supported. Symantec is the only virus protection solution that is tested and verified for use with all Pyxis products. Security Module v2.0 patch cycle: In response to Microsoft security bulletins, and to subsequent security and critical updates, CareFusion has the following process to address the communication of vulnerabilities and security patch management of supported CareFusion products. Initialize Microsoft Security and Critical Updates are released on the second Tuesday of each month. Identification All updates as released by Microsoft are selected for installation on the WSUS server in the CareFusion testing facility, and their applicability to CareFusion products will be determined using the Windows Update Agent inherent with each device. Assessment and prioritization Once the results are obtained, CareFusion reviews the results for each product regarding applicability, severity, and likelihood of exploitation. The results determine if additional information or testing is necessary, or if any special mitigating circumstances need to be considered. The results are presented in the Security Bulletins that outline each of the vulnerabilities and the associated risks to the products. Testing and certifying patches Applicable updates are tested for integrity and system compatibility on CareFusion products by CareFusion to ensure that the patches do not break or alter the product functionality. Approval notification and distribution Upon approval of the patches, the appropriate Field Service teams are notified that patches have been approved and will be automatically deployed to customers with Security Module v2.0. Customers running Security Module v1.x will continue to execute the manual patch deployment and installation process. CareFusion Page 4 of 6 April 4, 2011

5 Customer requirements System requirements Customer VMware infrastructure - Processor: 2 vcpu (reservation not required) - Memory: 2 GB (reservation not required) - Storage: 150 GB (thick or thin provisioning) Customer hardware (bare metal) - Processor: 1 CPU (2 GHz) - Memory: 2 GB - Storage: 150 GB (RAID1 or RAID5) Environment requirements A preinstallation questionnaire was designed to help CareFusion obtain all necessary technical information and allow for proper planning and successful installation of the Security Module. The form helps ensure the availability of the following: Hospital-assigned static IP address, subnet mask, and gateway information. Hospital DNS primary and secondary IP addresses. WINS server addresses (optional). TCP ports 80, 443, and 8014 communications to all CareFusion devices. TCP ports 80 and 443 outbound to the Internet If a facility intends to share one Security Module among several sites, consider the following factors: Sufficient network bandwidth. Administrative infrastructure and ownership. A route between networks needs to be available if the branch offices of the IDN are on separate networks. Following the vendor specifications, a theoretical limit of 1,500 devices per server can be supported. For further information, contact your Account Executive or Customer Service Manager. CareFusion Professional Services provides this document for use as a general resource only. Anyone using this document should determine whether it is compatible with applicable state laws, regulations, professional practice guidelines, and accreditation standards. Use of this document should be at all times governed by professional judgment of the user. CareFusion Page 5 of 6 April 4, 2011

6 CareFusion, Pyxis, MedStation, SupplyStation and the CareFusion logo are trademarks or registered trademarks of CareFusion Corporation or one of its subsidiaries. All other trademarks are the property of their respective owners CareFusion Corporation or one of its subsidiaries. All rights reserved. CareFusion Page 6 of 6 April 4, 2011