How to best encrypt a Windows file server drive in ESXi 5 for HIPAA compliance?

[ChrisLukowski81]

Hi,

I work for a medical practice and we're in a bit of a bind. Turns out that HIPAA laws require us to encrypt any data that may contain PHI and I suspect quite a few docs on our Server 2003 file server do. What I'd like to do is either create a new virtual disk (which would exist on our physical RAID array) that is entirely encrypted for the purposes of migrating user shares to, or create a new Server 2008 VM and migrate our data over if using BitLocker is our best bet.

I'm very new to encryption so a "101" explanation of the best route would be helpful. I understand it at a basic level but have no experience in deploying it on file shares that are accessed by multiple users. What I don't want is for them to have to enter in a password every time they access something on their user share. Ideally I'd like the end result to behave identically (from a user perspective) to their current mapped drives. I've heard of whole disk encryption that requires a password or USB key on boot-up but am not sure if those solutions are compatible with VMware servers. I also would like to avoid a complicated Active Directory Certificate Server solution unless there is some benefit to it. Finally, a solution that doesn't require me to manually modify each PC or laptop that would connect to the share would be ideal.

Thanks,

Chris

BTW- If anybody suggests BitLocker, can you also give your thoughts on the following FB article that states BL is not supported with VMware? http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=203614...

[sparrowangelste]

bitlocker is ruled out in your case because the article essentially states that  if something happens, vmwre and microsoft both will pass the buck since the config isnt supported.

Ideally you should look for something that encrypts it inside the windiows os.

how about a RMS from windows?

[Josh26]

There are very few things that Microsoft won't pass the buck on in a VMware environment, so I don't usually take those arguments too seriously.

However, Bitlocker only effectively works with a TPM, which is a hardware device, and I have never seen a method of passing that through to a VM. So no, you won't be able to use Bitlocker in a VM.

Are you sure this is a HIPAA requirement? I have never reviewed those requirements myself, but I have numerous medical clients and I've always told by them not to bother worrying about this sort of thing.

[jrmunday]

Bitlocker is not supported;

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=203614...

But, seems that it can be done ...

http://www.christowles.com/2010/10/how-to-encrypt-vmware-vm-running.html

[Josh26]

Jon Munday wrote:

But, seems that it can be done ...

http://www.christowles.com/2010/10/how-to-encrypt-vmware-vm-running.html

Just because it can be done doesn't mean it works.

If you "encrypt" a VM, then store the keys on that VM, such that it will boot seamlessly when a thief loads a Windows password reset disk, then all you have is theatre security - encryption for the sake of encryption.

[jrmunday]

Agreed, and I'm not endosing this either ... just sharing what others have done.

[aaronwsmith]

Regardless what solution you choose, policy will need to be a part of it. If the volumes where the documents are stored are encrypted, but users can copy content or the files themselves to an insecure end user device, then it is obviously no longer encrypted. You could also encrypt end user devices but ultimately a no copy policy is needed.

I recommend encryption of the SAN volumes themselves if possible. This prevents someone from walking off with the physical drives and be able to still access the VM that has the encryption software running within it. Also avoids issues with encryption software with guest OS potentially causing problems with the VM being stable or available to serve up the files.

[ChrisLukowski81]

I was really hoping for a solution that would allow me to encrypt VM virtual disks so I can keep it isolated to certain volumes.

[westcoaster]

Windows has builtin file/folder/disk encryption. You just open the properties for what you want to encrypt. Click the Advanced button and then tick "Encrypt contents to secure data". Windows will then perform the encryption and you are good to go. The encryption is transparent from that point on.

This is a simplified overview and you will definitely need to read up on how to set it up properly. The encryption is based on user certificates so you need to have that configured in your domain so that users can access the information and so that the administrator can always recover information.

[srwsol]

I use truecrypt ( http://www.truecrypt.org ) for many things and it works just fine inside a VM, and can encrypt a whole volume so that you can seperate the OS data from the application data, by just putting the encrypted volume on a different virtual disk.  As someone else pointed out though, you will have to give some thought to how the encryption keys are entered in order to access the data.  If you do it manually then someone who knows the keys will have to input them each time the virtual disk is mounted.  On the other hand if the requirement is simply to have the data never stored on disk in the clear, but there aren't stringent requirements for the handling of encryption keys,  then you can simply have the key stored with the VM.  If there are requirements for the key, then you have to get more creative.  Since the key can be of any length with truecrypt you can do something like give half the key to one person and the other half to another, thus requiring both to be present to input their half of the key.  It all depends upon what the requirements are, and that's something that you will have to read up on very carefully before choosing an encryption technology.  I used to work in the finanacial industry and they had very strict requirements about how the keys were to be handled and stored.

[not_sure]

I don't have too much experience with HIPPA requirements.  Similar to contruction workers with OSHA.

I belive you will need to get a lot more details before you can make a decision.  As the person above me said, the handling of the keys is paramount.

Although, details are not always out in the open so to speak.  If all you need to do is "encrypt those files", the easiest way to satisfy such a request - with the least admin overhead - would be using Windows file encryption (right click, encrypt).

[aaronwsmith]

Then you will probably have to pick a solution that makes use of encryption within the guest OS.  Might be solutions out there that can encrypt individual vmdk files without guest OS involvement but that would have to be something that is installed within ESX itself.  Whatever the solution, if it is too easy to decrypt or access those files and users can easily decrypt or copy the files out of the encrypted source with or without realizing it, then you have only security theater.

[westcoaster]

I guess the first step is to figure out exactly what you want/need to do under HIPPA. I'm not familiar with it myself.

Do you need to secure in case the server is stolen?

Do you need to secure in case a server disk is stolen or has to be removed?

Do you need to secure your backups?

Do you need to restrict which users can access files?

Do you need to prevent users from taking files from the system (i.e. copying to a USB drive)?

Do you need to to prevent or secure documents being transmitted outside of your system (i.e. document is sent via email)?

Do you need to secure against malicious insiders?

Only then can you design an appropriate protection scheme. For example, encrypting the files on the server is useless if you need to prevent outside parties from being able to open documents (i.e. once someone copies a document off the encrypted server to their computer or USB, all protection is lost).

You might need to encrypt the entire server, only encrypt certain files/folders/volumes, or you might need to protect the individual documents.

BitLocker might work but I'm not sure about what effect the lack of hardware TPM in the VM will have. I think there are ways around this those, such as if you use a PIN to 'unlock' the system at boot. This is probably the easiest option since after bootup Windows acts completely normally and you don't have to make any other changes. The fact that it's not support by VMware or Microsoft means that you probably can't use it thought. If there are ever any problems you won't get any help, and that is a very bad place to be when you are in trouble!

Using TrueCrypt could work as it would encrypt an entire partition, and after the partition is mounted Windows will treat it like any normal disk and users would be able to access documents as normal. Just make sure the password is stored safely so it is never lost.

Windows builtin encryption is a bit trickier, since each document is encrypted using certificates. A user must have a valid certificate (for that document) in order to open the document. You would need to read up on how to setup all this. The most important point is to have a "recovery agent" and to safely store a copy of its certificate (i.e. if Administrator is the recovery agent, then you need to export his certificate and store it on a USB or CD in a safe). If no valid certificate is available, then the files are forever unrecoverable. This can happen if say the server dies and you don't have a backup of the Windows installation.

To protect documents once they leave your system you would need to use the encryption builtin to each program. Microsoft Word/Excel/Emails and Adobe Acrobat offer builtin encryption and password protection, but you need to apply it to each document which makes it very difficult to manage. A better solution is to use Windows Rights Management Server or Adobe LiveCycle Server. Both of these products offer centrally-managed security policies for Word/Excel/Emails or Acrobat which makes it much easier to manage in a large scale environment.

One last thing, when you say "server" do you mean a specific Windows VM, or do you mean then ESXi host? Applying encryption to the entire host and VMDK files will probably be a nightmare, and I'm not aware of any way to do it. I think your only option is to encrypt from within the guest VMs(s).

[sdpate]

You can also use HighCloud to encrypt individual disks or the whole VM. We operate below the hypervisor and within the VM. The solution is free for up to 5 VMs.

For more information see www.highcloudsecurity.com - we also have a paper on using HighCloud in HIPAA environments in our collateral section. Go to Resources -> Collateral

Disclaimer - I work for HighCloud