3 ms·

The answer is "it depends". Did you read the article or just the headline? Scroll down to the bottom, under the section "A few considerations" and try not to

The answer is "it depends". Did you read the article or just the headline? Scroll down to the bottom, under the section "A few considerations" and try not to laugh. "A few considerations" turns out to be a pretty significant chunk of security work ESPECIALLY if you are storing/transmitting highly sensitive information. How do you handle something like HIPPA compliance when you're in this situation? There are 2 types of programmers: those that think they've seen everything and those that know they've seen next to nothing. And as such, these absolute takes are tiring.

pistoleer 2y ago
> How do you handle something like HIPPA compliance when you're in this situation? I'm a dev who hasn't seen anything related to that. Since you bring it up, can you give some pointers on why something like a MySQL db coupled to a monolithic backend isn't good enough? What shortcomings did you experience? All of the things raised in the article seem possible to solve without the need for microservices.
- mexicocitinluez 2y ago
  > All of the things raised in the article seem possible to solve without the need for microservices. First, this has nothing to do with microservices. Needing cloud infrastructure and building microservices are 2 orthogonal things. Second, it has nothing to do with the tech you're using. MySQL is irrelevant. So is a monolithic backend. What IS important is the security and infrasture behind the data your storing. Clinical data (and data captured in EMR's) is easily some of the most sensitive stuff you'll come across (unless you work in govt). The idea that I wouldn't use off-the-shelf, already-tested solutions specifically for this problem with a cloud provider is nuts. I pay Azure peanuts compared to what I'd have to pay a full-time person to manage multiple environments, security updates, provisioning new infra, etc. And that's not even considering the actual process you need to go to connect to outside systems. Most integrations want you to have a SOCS audits and stuff. What happens when there is a breach? Do you have the personnel on staff to understand and troubleshoot the issue? Remember the "we have your data and will release it for bitcoin" hacks? That's only made possible by these systems sitting in closets in someone's facility. And trust me, this isn't just a "large enterprisey" problem. It's a "everyone who wants to build an app in this space" problem. So you can use MySql (if you can host it compliantly) and I'm building what you could theoretically call a "monolithic" backend and it's working well. I use MSSQL on Azure though.
  - pistoleer 2y ago
    That makes sense, cloud infra does reduce risk in that sense. I assume you're allowed to say "we need to be compliant with X, and our cloud provider is compliant with X, therefore we are compliant with X". When something bad does happen, is the cloud company liable?
    - mexicocitinluez 2y ago
      Most of it falls on the shoulders of the providers not cloud companys. One aspect that's reappy hard to control is the whole human side of things. Most of my time in the "healthcare security" side of things is with employees opening emails with viruses in them and their constitutional incapablility of not clicking on links in emails. Im a developer who is a CTO for a healthcare company (not like a big corp or anything) and also administers an Office 365 tenant while building out custom apps and an EMR. The office side of things is so much harder to get secure.
christophilus 2y ago
I've written a HIPPA-compliant application that was VPS-hostable. It's been a while, but IIRC, it simply involved a combination of TLS everywhere and encrypting the sensitive fields in the DB. I don't remember if there was any other trick involved, but it wasn't difficult. By far the hardest thing about that project was the complexity of the medical codes-- not HIPAA compliance-- and that is something the cloud wouldn't help with at all.
- mexicocitinluez 2y ago
  > , it simply involved a combination of TLS everywhere and encrypting the sensitive fields in the DB. I'm sorry, are you saying securing patient data is simple? No offense, but you might be the only person on this planet to share this sentiment and there's a reason why. So, it's simpler to secure sensitive information in a database, secure your hosting, maintain security updates to those hosts, undergo audits, keep up with changing regulations, keep up with the latest threat vulnerabilities, staff a full response team in case something happens, etc? Not trying to be rude, but it's obviously not simple. What's crazy about your answer is that we had a whole host of "Bitcoin for your data hacks" that were only made possibly by setups your describing. >By far the hardest thing about that project was the complexity of the medical codes- Yes, this is also complex. But a totally different problem in a totally different space.
  - wadadadad 2y ago
    > secure sensitive information in a database, secure your hosting, maintain security updates to those hosts, undergo audits, keep up with changing regulations, keep up with the latest threat vulnerabilities, staff a full response team in case something happens To be fair of the things you've described, if you can swing it, you should be doing most of this regardless for a business setup. Specific to HIPAA would be the auditing and 'changing regulations' (and depending on client needs, you'll likely have other audits for business needs). I'm going through a gap analysis for HIPAA now; would you mind sharing what impactful changing regulations you've seen in the past 5 years?
    - 2y ago

pistoleer 2y ago

> How do you handle something like HIPPA compliance when you're in this situation? I'm a dev who hasn't seen anything related to that. Since you bring it up, can you give some pointers on why something like a MySQL db coupled to a monolithic backend isn't good enough? What shortcomings did you experience? All of the things raised in the article seem possible to solve without the need for microservices.

mexicocitinluez 2y ago
> All of the things raised in the article seem possible to solve without the need for microservices. First, this has nothing to do with microservices. Needing cloud infrastructure and building microservices are 2 orthogonal things. Second, it has nothing to do with the tech you're using. MySQL is irrelevant. So is a monolithic backend. What IS important is the security and infrasture behind the data your storing. Clinical data (and data captured in EMR's) is easily some of the most sensitive stuff you'll come across (unless you work in govt). The idea that I wouldn't use off-the-shelf, already-tested solutions specifically for this problem with a cloud provider is nuts. I pay Azure peanuts compared to what I'd have to pay a full-time person to manage multiple environments, security updates, provisioning new infra, etc. And that's not even considering the actual process you need to go to connect to outside systems. Most integrations want you to have a SOCS audits and stuff. What happens when there is a breach? Do you have the personnel on staff to understand and troubleshoot the issue? Remember the "we have your data and will release it for bitcoin" hacks? That's only made possible by these systems sitting in closets in someone's facility. And trust me, this isn't just a "large enterprisey" problem. It's a "everyone who wants to build an app in this space" problem. So you can use MySql (if you can host it compliantly) and I'm building what you could theoretically call a "monolithic" backend and it's working well. I use MSSQL on Azure though.
- pistoleer 2y ago
  That makes sense, cloud infra does reduce risk in that sense. I assume you're allowed to say "we need to be compliant with X, and our cloud provider is compliant with X, therefore we are compliant with X". When something bad does happen, is the cloud company liable?
  - mexicocitinluez 2y ago
    Most of it falls on the shoulders of the providers not cloud companys. One aspect that's reappy hard to control is the whole human side of things. Most of my time in the "healthcare security" side of things is with employees opening emails with viruses in them and their constitutional incapablility of not clicking on links in emails. Im a developer who is a CTO for a healthcare company (not like a big corp or anything) and also administers an Office 365 tenant while building out custom apps and an EMR. The office side of things is so much harder to get secure.

christophilus 2y ago

I've written a HIPPA-compliant application that was VPS-hostable. It's been a while, but IIRC, it simply involved a combination of TLS everywhere and encrypting the sensitive fields in the DB. I don't remember if there was any other trick involved, but it wasn't difficult. By far the hardest thing about that project was the complexity of the medical codes-- not HIPAA compliance-- and that is something the cloud wouldn't help with at all.

mexicocitinluez 2y ago
> , it simply involved a combination of TLS everywhere and encrypting the sensitive fields in the DB. I'm sorry, are you saying securing patient data is simple? No offense, but you might be the only person on this planet to share this sentiment and there's a reason why. So, it's simpler to secure sensitive information in a database, secure your hosting, maintain security updates to those hosts, undergo audits, keep up with changing regulations, keep up with the latest threat vulnerabilities, staff a full response team in case something happens, etc? Not trying to be rude, but it's obviously not simple. What's crazy about your answer is that we had a whole host of "Bitcoin for your data hacks" that were only made possibly by setups your describing. >By far the hardest thing about that project was the complexity of the medical codes- Yes, this is also complex. But a totally different problem in a totally different space.
- wadadadad 2y ago
  > secure sensitive information in a database, secure your hosting, maintain security updates to those hosts, undergo audits, keep up with changing regulations, keep up with the latest threat vulnerabilities, staff a full response team in case something happens To be fair of the things you've described, if you can swing it, you should be doing most of this regardless for a business setup. Specific to HIPAA would be the auditing and 'changing regulations' (and depending on client needs, you'll likely have other audits for business needs). I'm going through a gap analysis for HIPAA now; would you mind sharing what impactful changing regulations you've seen in the past 5 years?
  - 2y ago