Infrastructure and security requirements

1

• Infrastructure and security requirements

2
Scope

• Assess the system level resource requirements of
  the CREDO both in phase II and beyond.
• Hardware for servers (Unix machines)
• System level software
• Web servers
• Application servers
• Databases
• Mail server
• backup etc...
• Assess how the systems and in particular the
  clinical data involved in the project can be
  secured.

3
Determining Factors

• Delivery method of the applications.
• It is assumed that this remain web based, which
  conforms to the government approved eGIF
  standard.
• Location of the servers
• Located here at CR-UK or based in the hospitals
  within the NHS network.
• Dependencies on existing legacy systems.
• e.g. Existing clinical databases
• Estimate of the load that needs to be supported

4
Security

• Data Security during capture and subsequent
  access.
• Use Secure Socket Layer (SSL) on the web server
  to encrypt data to/from browsers.
• Security of stored data on the servers.
• Use authorization/authentication to validate
  users
• Use firewalls to secure the servers. This is will
  depend on the location of the servers and the
  local security policies of the site.

5
Hardware

• Servers hosted here at CR-UK
• Use the existing servers (the Openclinical
  server)
• Ok only if the numbers involved are quite small.
  
• Acquire and set up a dedicated server for this
  purpose.
• The test will not be effected by our local
  activities
• Provides a template for deployment on other sites
• Servers hosted at the trial site premises
• We probably will need new machines to host the
  service
• A set of issues may arise from factors such as
• The available computing infrastructure at the
  site
• Local policies (e.g. network access restrictions
  from outside) .
• The available expertise at the site.

6
System level Software

• Most of the system level software we currently
  use are public domain or open source. These
  include
• Apache web server
• Apache Tomcat Servlet container
• Possibly JBoss for the enterprise beans container
• MySQL server for Database
• These should be fine for the next phase of the
  project.
• We may need to replace some of these with
  industrial strength commercial products for the
  larger scale trials