idash Infrastructure to Host Sensitive Data: HIPAA Cloud Storage and Compute

(1)

integrating Data for Analysis, Anonymization, and SHaring

iDASH Infrastructure to Host Sensitive Data:

HIPAA Cloud Storage and Compute

(2)

Outline

Infrastructure Overview

Typical Scientific Workflow

Cloud Challenges

iDASH Cloud & SHADE

Repeatable Results

(3)

Enterprise

iDASH Environments

• Firewalls

• Separate VPN pool

• Physical separation

• Redundancy

• Two Factor Authentication

• Encryption at rest/in transit

• Centralized logging

• Intrusion detection

• Proxies and filters

• Hardened (secured) system

configurations

• Remote Backups/DR

PHI

Non-PHI

Cloud

Virtualization

Hardware

Website

PHI Repo.

Miconcur

iCONS

Non-PHI

Repo.

NLP

Privacy

…

Proj.1

Proj.2

Proj.3

Proj.4

HIPAA

(4)

Workflow

Typical Scientific Analysis

SaaS

PaaS

IaaS

Algorithm developers, Bioinformatics researchers, Sysadmin

Examples: Amazon EC2, Microsoft Azure

Bioinformatics researchers, Front-end developers

Examples: Heroku, Google App Engine

Biomedical researchers, Clinicians, Other end-users

Examples: Google Docs, Office 365

Short reads

_reference

Index

_reference

Align to

Call variants

Annotate

_variants

Pick high

_impact

Deleterious

_SNPs

(5)

To Cloud or Not to Cloud?

• Typical bioinformatics applications are NOT

cloud aware

• Almost nothing at PaaS – this is not web

development

• Most published cloud papers use public

Amazon VMs

• Privacy & Security are afterthought

• Data still goes around with unencrypted FTP

• End-to-end analyses need serious work

(6)

iDASH Cloud & SHADE Overview

S

afe

H

IPAA-compliant

A

nnotated

D

ata deposit box

E

nvironment

C

ompute & storage

e

L

astic, HIPAA-compliant

O

n-demand

U

ser-friendly

D

ata analysis environment

HIPAA and

non-public data

public data,

tools, recipes

Po wer ed b y MI DA S



Data



Tools



_Recipes

upload & download

_to

_SHADE

compute request,

direct upload & download of

proprietary data, tool, recipe

to

CLOUD

middleware and HIPAA security developed by iDASH



Compute nodes



_Memory



_{Disk storage}



Networking

Po wer ed b y VM wa re

AUTOMATED

(7)

Repeatable Results

Workflow

Short

reads

Index

reference

Align to

reference

Call

variants

Annotate

variants

Pick high

impact

Deleterio

us SNPs

Blueprint

Workflow

Short reads

Index

reference

Align to

reference

Call

variants

Annotate

variants

Pick high

impact

Deleterious

SNPs

Co

nt

ex

t

Reference DB

Test data

Configuration

Helper tools

OS

Blueprint Workflow Short reads Index reference Align to reference Call variants Annotate variants Pick high impact Deleterious SNPs Co nt ex t Reference DB Test data Configuration Helper tools OS Blueprint Workflow Short reads Index reference Align to reference Call variants Annotate variants Pick high impact Deleterious SNPs Co nt ex t Reference DB Test data Configuration Helper tools OS Blueprint Workflow Short reads Index reference Align to reference Call variants Annotate variants Pick high impact Deleterious SNPs Co nt ex t Reference DB Test data Configuration Helper tools OS

Instance

Workflow

Short reads

Index

reference

Align to

reference

Call

variants

Annotate

variants

Pick high

impact

Deleterious

SNPs

Co

nt

ex

t

Reference DB

Test data

Configuration

Helper tools

OS

iDASH

Bookshelf

MyDATA

Input

Results

iDASH

(8)

Improvements in Y4

• Ordered and installed additional hardware to increase

cloud capacity and provide tiered services:



180TB Dell Compellent tiered storage (SSD, 15K, 7.2K)



2 Dell R920 servers with 1TB Ram, 4 Intel E7-4870v2 CPU’s/15

Core

• Software and Security Improvements



Implemented Data Replication for DR



Upgraded to vCloud 6.0



Improved VM provisioning automation



Improved user portal

(9)

iDASH Cloud

3 computation tiers

3 storage tiers

10GbE throughout

Full redundancy

RSA Two Factor Auth.

Remote data replication

800+ cores

7TB+ RAM

(10)

Future plans

• Improve User Experience and Management

• Improve collaborative environment

(SocialCast, SHADE)

• Implement seamless vMotion of VM’s

between physically separate datacenters

• Experiment with VMware EVORail

with iDASH Cloud -> “Cloud in a Box”

(11)

Thank you!

(12)

Secure VM Templates

• Full disk encryption

• Built-in Firewall

• Secure shared memory

• No root SSH

• Protected su

• Harden sysctl networking

• Disabled Open DNS Recursion

• IP Spoofing protection

• Hardened PHP for webapps

• Apache application firewall

-ModSecurity

• ModEvasive protection of

webapps from DDOS attacks

• Automatic logs scanning and

banning of suspicious hosts

-DenyHosts and Fail2Ban

• Intrusion Detection

- PSAD

• Periodic checking for RootKits

-RKHunter and CHKRootKit

• Autoscan for open Ports - Nmap

• Analysis of system log files

-LogWatch

• SELinux / Apparmor

application

boundary enforcement

• System security auditing

with