Is SSL VPN an effective solution to secure hospital's remote access? SSL VPN is a kind of VPN that runs on SSL technology and is accessible via https over web browsers. SSL VPN helps us establish a safe and secured connection to the remote access systems available in the hospitals. These connections are setup between the transmission control protocol and the application layer protocols. It was popularly implemented in credit card security and online banking. There are some other applications of SSL VPN especially in health care industry.
In Hospitals there are times when the physicians, administrators ask for an easier and secured way to access remote information systems available at the hospitals; To support these demands many technologies which provide such security like single sign on, biometric readers and secured socket layer virtual private network with end point control were suggested. Because of end point control security, SSL VPN was mostly preferred amongst these technologies. Among various VPN solutions SSN VPN provides anywhere, any device remote access. In hospitals it provides a surgeon to gain direct access to the patient's records or results available in the hospital systems. This they can do from their home using their laptops or even mobile devices. They can schedule their calendar activities like keeping reminders on the appointments; they can access the patient's data or information available from the system. SSL VPN can take care of all the problems relating to security of data and their integrity.
This provides physicians lot of flexibility in managing their resources. As this process is an automated process it is very important that all the data is safe and secure. Hence we look for SSN VPN to provide that type of security. An Effective solution to secure hospital's remote access is Secure Sockets Layer virtual private network (SSL VPN) which provides secured access to the remote systems with their end point control security.
Users require safe and flexible access to the network resources for which they require secure remote access to the various systems available. There are many systems which are easily and securely accessible but there are some not known to the user, some are not safe for carrying out any transaction, some are not well managed systems, so we require some technology to provide solution to all these different types of systems and SSL VPN is one such technology which is used to provide safe access to these kinds of remote systems. The predecessor to this technology was IPSec. IPSec was used to access the remote systems available over network. There were times when dial modems where used to access the remote systems but later they realized it was a pricy issue and so the process of providing access to the systems through the public internet proved to be more economical. Tunneling into corporate networks with the help of remote access VPN that involved IP security was used to prevent problems like eavesdropping and congestion on Internet traffic.
In order to provide better and secure communication between the two end users of the systems, standard IPSec was used which protected IP packets between the systems by encryption methods. Encryption involved using IKE (Internet key exchange) in order to negotiate with the security services and crypto keys and to build secured communication between different peers. The whole process included encryption of the IP packets data payload, rejecting replayed IP packets and verifying the integrity of the packets. There were some add-ons to IP Sec i.e. an extended authentication which was used to provide communicate user logins and password. Installation of vendor supplied VPN clients would help vendors provide private IP addresses to the remote systems in a network.
With the advent of residential broadband which was a replacement for the old fashioned dial ups, offsite workplaces grew tremendously. These offsite workplaces allowed the employee to work from their house, while travelling. This access to remote systems through VPN helped mobile workers access their business mails while travelling with the VPN clients installed.
Because of these easy access options, demands increased and so it gave rise to increase in the workforce size and variety which in turn gave rise to new IT threats and security issues.
It is not always advisable to install VPN clients in places like worker's home desktop where there are possibilities of the family accessing the client and it makes the whole client vulnerable.
The possible solution to this would be an alternative to installing a VPN client, every time we want to access the remote systems. Such an alternative was found in web browsers where the web browsers use SSL (Secured Socket Layer) protocol or the latest TLS protocol to encrypt and verify HTTP messages sent by Web applications. So we have an option of using these web browsers and their tunneling protocols to deliver security services as IP sec. Web browsers are much easier to handle and provide various features. Hence these web browsers with SSL VPN emerged to fulfill the need of users to access their remote systems from their personal desktops, mobile and pda.
A dissolvable agent like an active x or a java applet is used by the browser to deliver client side processing which helps in maintaining users from diverse locations and different devices. It also reduces the cost of client administration. With the help of these connected systems a authorized user can access the authorized resources over the web by using the SSL VPN tunnel. The users here log into the SSL VPN through the web browsers. A two way interaction occurs between the users and the remotes systems and because of the use of SSL VPN we are assured of the security that is required for the resources available as in this modern world the biggest IT threat would be a security related threat.
There is some risk involved in providing the unmanaged and potentially compromised devices full access to complete network would be hazardous. This threat is related to all the systems from IT related systems or home systems or workplace centers or every system that is not well configured. SSL VPN's provide solution to this problem in two ways i.e.
- SSL VPN connects authorized users to the application and the data that they are allowed to access with the need to know access limitations. This helps in reducing risk by limiting business quality revelation. This is done instead of connecting all the trusted hosts to complete network.
- Tunnel end point security is provided by SSL VPN by providing access decisions that reflect both users uniqueness by using its identity and device security. Limiting access to remote resources by adjusting the resource authorizations can minimize threat exposure on various devices. In this importance is given to the device from which the user logs in as it decides as to what resources can the user logs in. The user rights should be different for a person when he enters into a company from home or from the company system
This will help provide better security and address the security issue discussed above
Let us take an example for the above case where the user can be given rights of read/write for a file when he is accessing information from managed systems, read only access on undefined end points and no access rights to virus prone systems. The whole process of using SSL VPN is when a user logs into a file system then the user will be provided access to information that are visible to him or will be shown only those folders on which he can access information. All other folders are hidden from the user so there is no way these folders can be affected. These options of providing end to end security, user focused accessibility are required to securely develop remote access to varied communities.
SSL VPN appliances are deployed at the trust boundaries, just like IP Sec VPN concentrators. These appliances provide validate, authorize, secure access to private resources present at the resource systems. These appliances use SSL VPN encrypted tunnel in order to transfer information or access rights to resources across the two end systems over the internet. There is a bit variation in how the SSL is applied and what information is passed in the encrypted tunnel of SSL. Early products of SSL VPN concentrated on web based applications and it had to follow the standards that the browser offered. SSL VPN evolved when the users realized that the previous web applications were very basic level applications and these applications did not support most of the remote user needs. SSL VPN defines a set of access methods that its appliance supports.
Access Method of SSL VPN clients:
- In the first access method it provides access to any web application where the browser tunnels over SSL and then to the VPN appliances just like the way it would for any web server. Here the VPN appliance performs the operations of web proxy where it maps the external URL to the internal addresses before the sending the HTTP to the private server available. As it is a two way communication. On the way back SSL is used again to tunnel the server responses back to the users which are done by the VPN appliance.
- In the second method as compared to the interaction with the web services, here we look at the interaction with the non web applications like example: communication with the popular mails and terminal services. The dissolvable agent of the VPN here becomes the application client and it sends the HTTP request to the VPN appliance tunneling over the SSL. Mapping of the HTTP is done by the appliance into the native application protocol where it is relayed to the non web applications. Inbuilt content translators are provided in the business applications, these applications related content translators are required for the implementation of this method.
- In order to accommodate the non browser based client applications, SSL VPN agent is used. The users here interact with the TCP client applications which are installed locally in the user required manner. These specific TCP ports are bind by the SSL VPN agent and are forwards native application protocol through the SSL tunnel. The VPN appliance acts as a reverse proxy where it relays the application related messages to and from the private TCP servers. The whole above process is broad purpose and it can support a wide range of TCP server applications. In order to activate the agent definite browsers are required or sometimes some plug in or even some administrative privileges are to be provided on the remote host.
- The last method here even though is broader to the above methods is not widely implemented. Tunneling of IP packets are done instead of the TCP sessions by the SSL VPN agent. This is logically almost similar to IP Sec as it provides full network access privileges to the applications that need such high privileges and deserve it. Some examples would be VOIP or a managed system. In this method the products of SSL VPN actually install a unrelenting network connector agent. The choice of access methods are provided to the user by the use of appliance portal and policy agents.
These methods have successfully evolved to support different kind of systems, applications and users. In an organization that supports a large varied work force will face trouble or difficulties in bringing all into a single remote access solution. These varied options of using different methods have helped SSL VPN take over the business of IP Sec VPN. Thus a shift from the IP Sec VPN to deployment of SSL VPN was done in order to satisfy varied remote access needs.
Categories of SSL VPN security:
SSL VPN provides an entry into the corporate infrastructure by providing utmost security. Security by SSL VPN is one of its critical components. As there are many categories of SSL VPN security products which have different and distinct security related capabilities in them, it becomes very important for the corporate organizations to choose what kind of security it would want to implement. The different Categories related to SSL VPN security are as follows:
- Authentication and Authorization: This type of security is required when the users are allowed to access some data or information which has to be protected from any infection. When a user gains access to some information or a remote system, they are able to do that with SSL VPN. During this whole process of information access it becomes very important for the information supplier to check that the information or the resources is only accessed by the authorized users. It is important that a user is able to access the resource only till the level he is allowed to, all this can be done with SSL VPN.
- End Point Security: This type of security is also known as the security provided at the client-side or at the browser side. Here the end point security refers to technology that has to be implemented in order to prevent any security related issues occurring on systems used to access the resources of the other remote system through SSN VPN. When we compare this technology with the previous remote access technologies, we can see that SSL VPN allows access to remote systems and its resources from the systems which are not secure. The end point security standards for SSL VPN are pretty different from other old remote access technologies and hence it is one of the better technologies to provide the end point security. Usually the problem arises when there is some sensitive data present in insecure regions, cookies generated during the user access of the system. These problems have to be solved by giving proper end point security.
- Server Side Security: It is also known as Network Security which in turn refers to protecting the resources that are internal to corporate organization which also includes SSL VPN server itself falling prey to any type of negotiation. Here the problems related to firewalls and other technologies being undermined, application level vulnerabilities, encryption and patching of SSL VPN servers are corrected.
Authentication includes using of technologies like providing passwords, one time passwords, Client certificates, use of smart cards and two factor authentications. Hence authentication via SSL VPN is a much secured affair. Authorization deals with permissions where different access permissions are provided to the user and they are authorized with different permissions like operating system permissions, file system permissions, native application permissions. Then there is authorization information which is maintained by SSL VPN in order to cross check the above authorization permissions. It also maintains a third party database of different third party authorizations.
All the above technologies are integrated and implemented to get the working of SSL VPN.
SSL VPN Planning and Implementation
As we look at the deployment of any new technology, we look at the approach it follows for its deployment. In case of SSL VPN Planning and Implementation the approach that is followed is a phased approach where successful deployment can be obtained by step by step implementation process. Phased approach is used in order to cut down on unanticipated issues and discover forthcoming pitfalls early in the process.
The different phases are as follows:
- Identify Requirements: This phase involves that part of the process when identification of the current and the upcoming requirements for access of the remote systems and determining how they are best met by an SSL VPN implementation. In Hospital case we must realize what the requirements of the system that has to be accessed by the doctors, IT staff are and get a list of requirements. Once requirements are available, second phase follows
- Design the Solution: In the second phase of the implementation process all aspects of designing a SSL VPN solution for the above requirements are met. There are five categories of design elements:
- Access control: This component deals with designing access control policies. Access for the SSL VPN users to the resources is gained based on characteristics. The different characteristics are user identification, computer location and most importantly the level of authentication.
- End point security: This component deals with designing the end point security controls. Some end point security controls provided by SSL VPN are to check integrity of host and mechanisms for security protection. Host integrity ensures that client is in fulfillment with an organization's lowest level of security policy. Integrity checks include checking for type and version of the operating system, antivirus and personal firewall status, registry key, a specific file and process that is running.
- Authentication: This component deals with selecting the method of authentication. The various ways to authenticate SSL VPN users include use of technologies like LDAP, RADIUS, digital certificates and active directory.
- Architecture: This component deals with designing architecture of the SSL VPN implementation process. This includes high availability configuration, portal design, firewall and routing considerations, hardware selection and device placement.
- Cryptography policy and FIPS Compliance: In the last of the sub sections of the components, selection of a cryptographic policy by the organization should be done. It needs to be chosen in a way that it is accommodating all the requirements and fits all the needs. It becomes very important for the IT administrator in the hospital to choose the right kind of cryptographic modules that have complex algorithms and method that satisfy the requirements of hospital.
- Connectivity: In order to access resources that are intended to be accessible by the SSL VPN, a user must establish and maintain SSL VPN connections. It becomes important to be able to verify if all the applications are accessed by the operating systems and browsers that a user uses. Firewall should also not block the connectivity especially when SSL VPN deals with multiple interfaces and sites. In Hospital case the doctors might want to access the information systems from different locations and hence it is important for a proper connection so that easy and secure flow of information takes place.
- Logging: Organization's policies and strategies play important role in proper working of the logging and the data management functions.
- Management: Configuration and management of the solution effectively and securely has to be done by the administrator. They should be able to verify that backups of the data have been created and data can be restored from them easily. This is also important in hospitals as the patient information is very important information which cannot be lost as collection of all patients information for the doctor would be a long term process, hence backup of all the data related to the patients and all the information system should be present.
Training is given to these pilot users in form of end user training and even help desk support training is provided so that they understand the different features offered by SSL VPN and become comfortable in using them. The different type of training provided is in hands on sessions or lectures. Documentation is also done so that it can serve as a reference in supplementing the training. Rich training should be given to personnel who are at the help desk support as their role is to help users in troubleshooting when they have some problems and should also be able to help users in establishing the VPN connectivity. When the pilot program is small then the pilot users can be trained by the group that deploys SSL VPN. The priority to train help desk personnel can be next.
Once the program has been launched, it is suggested that the organization gradually migrate from the existing network infrastructure, applications and users to the new SSL VPN supported solutions. The impact of SSL VPN can be evaluated to see if this solution can be deployed over the enterprise. There is a technical document which is generated during the deployment phase which should include the following:
- Instructions of how to configure the SSL VPN devices to their present stage.
- Access control policy
- Procurers that have been set as standards for the SSL VPN implementation.
- Configuration of firewalls and routers policies.
- End point security requirements.
Issues that arise at various stages during the deployment process:
- Negative effect of encrypted traffic are when they affect services such as firewalls, intrusion detection, remote monitoring probes, quality of service and congestion control protocols.
- Unforeseen performance issues may arise, either with the SSL VPN components themselves or with their intermediate devices like routers.
- Issues arise when the SSL VPN traffic is blocked because of some firewalls, routers or other packet filtering devices which do not allow proper flow on production networks.
- There are high chances that the environment changes during the deployment. There may be some new applications installed or the existing software had been upgraded which change the environment in which it was deployed.
There is another chapter to managing SSL VPN solution i.e. handling operational issues. Performance is affected when there is some connection problems related to fragmentation. Fragmentation occurs when packets that are transferred are broken down into small fragments which then need to be reassembled at the receiving host. Troubleshooting is helped along the way with the SSL VPN device logs and client logs. Firewall and router logs may authenticate whether the SSL VPN traffic is reaching them, passing through them or if the firewall blocks them.
SSL VPN in Hospitals
Many hospitals located at various regions are facing issues that has become very common problem in hospitals i.e. physicians and administrators were asking for easier remote access to the hospitals information systems. In the mean while the IT staff thought of an increased protection for those resources which are to be accessed by the users. There are many technologies that have come up which address the problems like e-prescription systems, proximity cards, biometric-readers, single sign-on (SSO) solutions and SSN VPN with end point control. These technologies help in providing secure remote access.
The philosophy that goes behind selecting the technology and afterward and implementation of the technologies was to outsource less work and manage most work in house. In hospitals it becomes very important that the solutions that are deployed should meet goals, easy to manage, should require minimal helpdesk support and provides enhanced network access. SSL VPN should be implemented to satisfy all these needs.
These days there are users which demand different requirements like wanting more access to our network from different locations i.e. remote locations which include private residences, wireless hotspots, partner offices and other health care organizations. The disadvantages of IPSec worked as advantages for SSL. Disadvantages of IP Sec was that it was not needed by the doctors anymore, who wanted to work remotely and there were some security issues with IPSec where it could not provide high level of security which was required for the remote access. IT staff had to verify if every remote end point computer consists of latest antivirus signatures and critical security patches for operating system. Verification of the authorized user had to be done before giving the access to the network.
All these security checks could be done only on the network users. This would be time consuming and burden for the IT department. IPSec would not provide end point security and because of constant network access it was not a suggested technology for remote access.
SSL VPN offers many features that were not offered by IPSec VPN. SSL VPN offered ease of deployment, robust end point control and multiplatform support. In order to save the systems and the information from the virus attacks the criteria for selecting SSL VPN was that it provides end point control. SSL VPN could also be selected as it would provide abilities to question devices to ensure certain applications like up to date antivirus software were running. It would pair this information with the user identity to decide on the privileges of access. The doctors or the physicians would be given different access rights to the patient's record when compared to the administration staff. Different information was available for the different users and they could not interfere in each other's information. The different priorities in selecting SSL VPN also included ease of use and ease of management for access from both managed and unmanaged devices. One more criteria was to select solutions in such a way that it could handle all sort of devices, applications as a single entryway for remote users like doctors, administrator staff, patients. One of the famous SSL VPN vendors is Sonic WALL Avential which is in this business from a long time and was able to successfully implement SSL VPN is many health care organizations. There are some cases when the users faced difficulty accessing the IDX client/server application over the SSL VPN portal, for this the solution would be to ask the support specialist to isolate the problem to a resolvable ActiveX issue, thus access to the users was provided just the way they needed.
With the help of SSL VPN users who could access the resources were given easy, secure remote access without much hassle to install it at home. The physicians and the administrators could easily access the windows file servers, corporate intranet with financial applications, HR information, electronic patient records and digital access from their home desktops, laptops, mobiles or pda's.
As the SSL VPN provides clientless solution over internet, many doctors or users who had their separate clinical systems could easily access the main server system as it was not necessary to set up complex site-site tunnels or exception rules for the firewalls.
In order to deploy a SSL VPN solution into the hospital it is important to see if the infrastructure of the hospital can support its deployment. Many hospitals require multiplatform support and SSL VPN provides that feature.
Various technologies can be integrated with the SSL VPN to provide better security for the users and even the host servers. One such example is proximity identification where a physician is given a proximity card which can be interpreted by the computer in the ED. With this the user does not have to type its user name when it tries to access the remote controls at the hospital. We can integrate this system with a biometric reader where the user does not have to type his password; instead it can just get his any of the sensory part (finger print) scanned as the password. Once the user name and the finger print matches the user can log onto the system that it wants to access. All this integration is well supported by SSL VPN.
Extensions to the existing system:
With the help of SSL VPN the hospitals can provide various access privileges to the users like physicians where once the physician is logged in and is using different applications then the user does not have to log in into each application as only those applications which it can access are made available to the users. Options of accessing e- patient's records, the scheduling system, and patient registration system are all made available to the physician. Some future applications that can be installed are e-prescription medication order entry system for the physicians that will integrate SSL VPN. The doctors here can use this technology to ask for various electronic tests like medical imaging test and even medication ordering. All these integration is a made much easier because of implementation of SSL VPN.
Advantages of SSL VPN
ü Unique features provided by SSL VPN such as SSL VPN uses SSL protocol to provide secure connectivity between different remote users and internal network resources. Ubiquitous nature of SSL VPN in many browsers allows it to be used in many remote locations also. Users do not have to install any client like in the case of IPSec which makes it easy to connect to different client machines. SSL VPN for this feature is already known as clientless VPN. Hence many doctors would be allowed to access the information that they need from different remote locations.
- SSL VPN is easy to use for end users. SSL VPN gives users an option of using their favorite web browsers rather than being restricted by their operating systems. Hence it allows users trying to access information from the hospitals varied options of browsers.
- SSL VPN also provides advantages for end users in the area of outbound connection security. Most environments that implement SSL VPN do not block outbound secure HTTPS traffic which is based on SSL. It provides restriction free access for the doctors or the administrators trying to get the connectivity.
- SSL-enabled proxy server is an application doorway that supports certain applications.SSL VPN does not require additional client's software to be installed on the end point device. In order to support various applications downloadable tunneling client is available and delivered. This is important for the client machine for it to support the various SSL VPN capabilities. This makes it easy for the doctors, administrators to easily handle the clientless VPN as there is no much difficulty involved in using it.
- SSL VPN also provides a feature of deleting securely all the downloaded file as the connection is terminated. This avoids hackers in obtaining information from the non trusted machines. Hence when a doctor log off then all the important patient data is deleted. If it is not done and if any one changes the data in patient's records then the consequences will be hazardous where the doctor might treat the wrong patient with the wrong medication after looking at its infected records.
Disadvantages of SSL VPN
- When the client platform security is compromised, it gives rise to security based problems. Many vendors have developed mechanism in order to boost the trust on non trustable machines connectivity. This could be harmful when the user accesses from a public computer space like an internet parlor. Scrutiny of the users should be given high priority in order to overcome any security related problems. In the case of hospitals all the users should not be given access as they might be accessing the information from public places which might give rise to problems later.
- There are methods like Active-X and java applets to enable SSL VPN, but the same is used by the hackers. In such a case client integrity has to be maintained which limits the number of clients or users that can be connected. In case of hospitals whenever a doctor downloads an applet to use a specific feature into the remote system it might give a freeway for the hackers to use the same information by downloading the same applet.
- Sometimes authentication of users and their credentials can be saved in a system for a user to save time in accessing the system but because once a doctor log off form the system all its information is deleted for which if the doctor wants to access back the system it has to go through all the procedures of authentication again which is time taking in case of an emergency situation.
- Vendors if they install any additional support through the use of protocol redirectors makes it compulsory for the users to have working knowledge of the support system which might lead to confusion as many doctors or the administrator staff does not know much about the application.
- The biggest disadvantage of SSL VPN is that it cannot provide privileges to the users on the basis of source IP addressing as SSL VPN are proxies from only one IP address and so all clients are connected through the same IP. This takes out an option of filtering and controlling the traffic based on IP source. Many doctors might have to attend an emergency situation and if then all the doctors are not provided access at the correct time then it might cause bigger problems.
In future if the above problems are solved then SSL VPN would become one of the most powerful and trustable tool to provide highly secured connectivity between remote clients and the host systems. Each of the disadvantages should be worked on and in the future a hassle free, multi IP source support, saving the authentication information of users once the users location or system is validated in order to save time on authentication process and most importantly should refine its validation rules to allow access by any non trustable system.
Secured Socket Layer Virtual Private Network is the secure way to allow remote access across the remote systems in a hospital. The doctors, administrators are provided with utmost security and are allowed to access the remote systems or the host systems from any remote location with the help of any web browser. Its end point security helps authenticate users and provide privileges to the doctors or the administrators to access the information from the host machine. Doctors can view the information of the patients and other information in order to provide better assistance in case he is not available at the site of the hospital. This remote access options helps to group many doctors, various patients, administrator staff, IT staff to be in connection and they can communicate with each other to access the information from each department to provide better availability of hospital resources to the patients. Security is required when communication occurs between these departments and that security is highly provided by deployment of SSL VPN solutions. SSL VPN provide an option of better productivity enhancements, improves availability of information and its deployment cost less so IT cost will be reduced.
- Company: Cisco
Author: Steven Song
- E-Book: Title: Guide to SSL VPNs, COMPUTER SECURITY
Author: Sheila Frankel, Paul Hoffman, Angela Orebaugh, Richard Park
Year of Publishing: July 2008
- Tutorials: Title: How to: Get Secure Remote Access with SSL VPNs
Author: Lisa Phifer
Year: December 11th, 2008
- Article: Better remote access, secure endpoints: an upgrade for an outdated remote access solution extends the network while bolstering endpoint control
Source: Health Management Technology
Year: October, 2007
- Article: All about SSL VPN
Retrieved date: From September, 2009 to November, 2009
- Link: http://en.wikipedia.org/wiki/SSL_VPN
Author: Anonymous author.