Re: Adding a disk to a RAID array

I've dealt with DoD Federales on some locked room programs with Tempest
thrown in. (I don't think the civilian Feds have adopted quite that level
of stringency, yet. Wait for it. Then buy all new hardware. <sigh>)

That said she faces two opposed problems. The Feds demand access type
security. The hospital demands access to records from a patient safety
angle. The latter demands the always up situation. This is probably best
served with a cluster of identical machines with identical databases,
sort of mirroring RAID at the machine level.

Second best is the suggested cheap PC hung off, perhaps a second NIC, on
the master machine. It uses that NIC to grab periodic updates. It is the
machine that is used to drive the tape deck on its latest data snapshot.
Yes, all the tapes need security handling. And the beancounting Feds are
probably demanding that the tapes never be reused, which compounds the
problem.

With the second best scenario the second machine has a normal net address
and the master machine has it blocked from the main network via IP Tables
and the main network blocked from it. The only "transactions" made are
through the second NIC with a special one address routing. Thus the second
machine is up to date with the first and completely isolated from the main
network. When the main machine goes down Elizabeth will have to hustle
down to the vault and pull the main and side network cables from the main
machine, setup the second machine with a special IPTables setup to NAT
the main machine's address to its own so that it looks like the main
machine to the main network. Then plug the main network into the secondary
machine. This should take no more than five minutes plus "travel time".
So patient safety is not compromised as little as possible while the
Feds are satisfied with the security, since both machines are on the
same software and same setup except for their network address. IPTables
address translation takes care of that issue when the second machine
needs to go online.

If course, I leave it up to the student of security to critique, amend,
and implement the above rather sketchy description. And it should keep
lawyers and feds happy, if not the corporate "don't spend any money"
people.

{^_^}


----- Original Message ----- 
From: "Rick Warner" <[email protected]>
> What Elizabeth is getting at, and she used the fancy 5 letter acronym in 
> one of her posts, is that there are new regulations on securing personal 
> medical information and apparently her Linux box houses data that falls
> under these guidelines.  If you have not dealt with the federales and 
> these types of security issues then you might not appreciate how stubborn
> they can be - and how expensive non-compliance can be.