Mirth Connect Security And Vulnerabilities

SECURYIN MIRTHCONNECTBest Practicesand Vulnerabilitiesof Mirth ConnectAuthor:Jeff CampbellTechnical Consultant,Galen Healthcare SolutionsDate:May 15, 2015galenhealthcare.com 2015. All rights reserved.

Best Practices and Vulnerabilities of Mirth ConnectTable of ContentsOverview3What is Mirth Connect?3Securing Mirth Connect Interface Engine3Certificates for Mirth Connect Server4Securing the Mirth Connect Frontend5Users and Permissions5Enforcing Security and Policies for Passwords5Auditing Mirth Connect Users6Securing Interfaces in Mirth Connect6SSL Manager (Connectors)7SSL Tunnels7Encrypting Message Content Sent from Mirth8Conclusion28

Best Practices and Vulnerabilities of Mirth ConnectOverviewWhat is Mirth Connect?Whether trying to comply with HIPAA, SOX, FIPS orany other federal regulation regarding the robustnessand integrity of data, security is a paramount concernwhen it comes to an interface engine that too often hasbeen underemphasized. When talking about securingan interface engine, most organizations are aware ofand take steps to ensure the data entering and exitingthe application is secured in some form, usually a VPNas many legacy systems are only capable of traffic overTCP\IP or directly to file. This is often seen as enough asthese applications often reside on internal servers whereorganizations feel they are safe and protected by their ownor contracted IT staff and it is only the data leaving thepractice that must be secured.Mirth is a cross-platform interface engine that enablesbi-directional sending of messages over numerousprotocols including TCP/MLLP, directly to database(MySQL, PostgreSQL, Oracle, Microsoft SQL Server, ODBC),file, JMS, FTP/SFTP, HTTP, SOAP, or SMTP.This is not enough in most cases however as there are amyriad of places where sensitive data is left unsecured onthe appliance, creating the possibility where a maliciousperson could breach the integrity of the interface engine.What about the storage of the messages itself as theypass through the application? How is the applicationfor the interface engine accessed and how granular areits permissions? Is there the possibility of interceptingtraffic as it leaves the server via a packet sniffer? Many ofthese areas of concern may have options in the interfaceengine to be secured, either through global settings onthe application or the interface handling the traffic itself,but enabling those options may very well have their ownconsequences which must be taken into consideration.As an example of hardening an interface engine andcovering many different points of failure for the integrityand security of its messages, I will be highlighting securityoptions for the Mirth Connect interface engine (v3.1.1) inorder to promote Healthcare IT best security practices.3Securing the Mirth ConnectInterface EngineBy way of default installation, there are several areas thatare left extremely vulnerable and/or encryption is left eitherat a lower strength than recommended or disabled entirely.Many of these areas can be configured or added to themirth.properties file found at the installation path Mirth/conf/mirth.properties for the Mirth installation. Howeverfor most default installations these are not added orconfigured, allowing for potential vulnerabilities tobe left exposed.For example, the Mirth Connect server service itselfconnects to a database through the use of connectionsettings held in the mirth.properties file. From a defaultinstallation, even for Mirth-installed appliances, theseare often stored in an unencrypted plaintext form,allowing for any and all with access to that file to viewpotential admin passwords and usernames to the Mirthdatabase. This could potentially expose other databaseson the same server as the account the Mirth Connectservice is configured to use to may also have accessto other databases.

Best Practices and Vulnerabilities of Mirth ConnectFigure 1.3: Mirth.properties file after enc

May 15, 2015 · download upgrades, restart services, and otherwise configure the physical or virtual appliance for Mirth itself. A Control Panel user cannot log into Mirth Connect, but . A Mirth Connect user can log into the Mirth Connect . ap