#Security

I found myself in the not-so-comfortable situation of working with a Linux system on which someone had accidentally disabled user access to the Linux shell. HealthConnect was running, servicing hundreds of interfaces. To resolve the access issue, though, we needed to bring the host down for the application of a fix.

Without the shell, the iris command is not available to control the instance, so we were faced with the potential of shutting down the server ungracefully. We wanted to avoid that if possible ...

IRIS makes SIEM systems integration simple with Structured Logging and Pipes!

Description

This is a template for a Flask application that can be deployed in IRIS as an native Web Application.

How do you authenticate with a rest api? The rest api implemention allows us to add in the header Authentication: 'Basic ' + btoa(user + ':' + password) but it is not really secure as a user can inspect and with the right decoding tool see a user password

Hey Community,

Enjoy the new video on InterSystems Developers YouTube:

⏯ Security Database and Wallet - Encryption, Mirroring and More @ Global Summit 2024

https://www.youtube.com/embed/wwwnTOCT03Y
[This is an embedded link, but you cannot view embedded content directly on the site because you have declined the cookies necessary to access it. To view embedded content, you would need to accept all cookies in your Cookies Settings]

Is there any mechanism already implemented in IRIS to prevent XSS exploits ?

This case happen when user input html/javascript content into fields and submit the page. If saved content is rendered as is, it's going to be executed by anyone visiting the page.

What I am looking for :

Hello community,

in addition to HL7 V2 interfaces mediated via TCP/IP, we have been implementing more and more HS.FHIRServer.Interop.Service based services that are addressed via port 57772.
We would like to secure access to the Management Portal now and have come up with a procedure that I would like to discuss.

Auditing is a critical capability ensuring the security of your server, and for quite a while ago we have included the ability to audit SQL statements run on the server.

With v2024.3 out already we're providing finer-grained options for defining these events to audit.

I attended Cloud Native Security Con in Seattle with full intention of crushing OTEL day, then perusing the subject of security applied to Cloud Native workloads the following days leading up to CTF as a professional excercise. This was happily upended by a new understanding of eBPF, which got my screens, career, workloads, and atitude a much needed upgrade with new approaches to solving workload problems.

So I made it to the eBPF party and have been attending clinic after clinic on the subject ever since, here I would like to "unbox" eBPF as a technical solution, mapped directly to what we do in practice (even if its a bit off), and step through eBPF through my experimentation on supporting InterSystems IRIS Workloads, particularly on Kubernetes, but not necessarily void on standalone workloads.

eBee Steps with eBPF and InterSystems IRIS Workloads

I created a Dotnet api to connect with IRIS database to do some task.
"InterSystems.Data.IRISClient.dll" (NativeAPI) is used in dotnet api to connect IRIS.
I used following code in dotnet to open and close the IRIS connection.

Up until recently, I have been toying around with REST/FHIR capabilities but only internally. Now I have a request to make REST API calls outside of our Network.

I am using an RSA 4096 key, because Microsoft Active Directory Services which generates the signed certificate could not handle the Elliptical Key (ECC) when I put the request in.

Introduction

In today's rapidly evolving threat landscape, organizations deploying mission-critical applications must implement robust security architectures that protect sensitive data while maintaining high availability and performance. This is especially crucial for enterprises utilizing advanced database management systems like InterSystems IRIS, which often powers applications handling highly sensitive healthcare, financial, or personal data.

Hi,

I'm trying to create a user with access to the HS namespaces management portal.
I'm having trouble identifying the correct resource to assign to the user. I'm testing various resources, but every time I go to the HS management section, a blank page appears, and the Home button disappears.

Background:

This guideline provides an overview of how to design and implement a REST API interface for querying patient demographic data from an Electronic Patient Record (EPR) system using HealthConnect. The process involves sending a query request with the patient's identification number, retrieving the response from the EPR system, extracting the required patient demographic data from the HL7 message, and sending it as a JSON response to the supplier. The high-level process diagram is shown below (Screenshot 1).