Security Backlog

This document shares current curated security backlog with features and capabilities that are defined in Security Jira board. Please refer Bahmni Security Posture document to get a holistic perspective.

Categories

Capabilities / Features

Documentation/JIRA

Bahmni Lite v 1.0 Release

Trivy Secret & Vulnerability Scanning

Analyze false positives or perform quick fixes on Critical vulnerabilities (First Pass)

BAH-241632584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

DONEGreen

Perform Vulnerability check in CI (build) using Trivy and fail for Critical issues. Add secret scanning using Trivy in all Bahmni repositories

BAH-219332584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

DONEGreen

Machine / Node hardening

OpenSCAP for nodes / machine monitoring

BAH-214232584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

DONEGreen

Apply daily critical security updates automatically (e.g EC2)

BAH-241232584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA BAH-238232584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

DEFERRED

Firewall

OpenSource / Free option for Bot Management and Traffic Control for Bahmni running on Docker / K8s

BAH-241332584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

DEFERRED

Document AWS WAF and Bot Management recommendation for Bahmni Lite

BAH-241432584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

DEFERRED

Security Quality Gates

Explore OWASP Zap for Bahmni Security Testing

BAH-196132584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

DEFERRED

Automate Static Code Analysis using DeepSource / SonarQube → Documentation

BAH-195832584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA BAH-195932584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

DEFERRED

Data Protection

Protect patient documents behind Login (only for older RPM based installation since docker and k8s no longer have this issue)

BAH-241732584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

Not APPLICABLE

Encrypt documents at rest (S3/FileSystem/Connected Storage/etc) e.g. Patient Documents

BAH-241832584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

DEFERRED

Identity Management

Mitigate default credentials risk

• Ensure Change password on first login e.g. superman
• Remove default creds from code e.g. .env, values.yaml etc

BAH-196032584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

DEFERRED

Cloud/Infra

Document recommendations on General Cloud hygiene

PARTIAL DONE

Document Approach on Reporting security incident (Slack, DL etc)

DONEGreen

Source Code Fixes

Fix hip service critical vulnerabilities

BAH-255032584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

ABDMRed DONEGreen

Fix hiu backend critical vulnerabilities

BAH-255132584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

ABDMRed DONEGreen

Fix hiu-ui critical vulnerabilities

BAH-255232584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

ABDMRed DONEGreen

Fix critical vulnerabilities in ABHA verification repo.

BAH-255332584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

ABDMRed DONEGreen

Fix critical vulnerabilities in Hiu-db code

BAH-255432584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

ABDMRed DONEGreen

Fix Critical Vulnerabilities in Appointments, Bahmni-lab, Bahmni-web, implementer-interface and patient-Documents images/jars

BAH-255732584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

requiredRed DONEGreen

Fix Critical Vulnerabilities in the crater-atomfeed repo

BAH-278632584f0f-f83d-3b0b-b91f-826465c6b0b8System JIRA

requiredRed DONEGreen