TextUp last-mile to initial HIPAA compliance

[x] rotate out all IAM keys
[x] implement IAM password policy
[x] Investigate disabling root user on EC2 servers
[x] Install OSSEC on TextUp servers. Investigate that OSSEC has the following functionality: set-up monthly emails for OSSEC reports, including if OSSEC providers user access logs, automated reporting for potential security incidents, scans every 2 hours and at reboot
[x] Investigate if vulnerability scanning of production systems can be done by OSSEC
[x] Investigate restricting modifying time data information on production systems and ensuring the clocks are always synchronized to NTP
[x] Investigate server firewalls for DOS attacks
[x] Disabled Tomcat7 manager access point and user
[ ] Investigate revoking ssh AND database access to EC2 servers
[x] Update MySQL passwords and add to LastPass
[x] Investigate MySQL password policy
[x] Investigate AWS CloudTrail for logging access to production systems by AWS IAM roles
[x] Plan for basic acceptance testing on frontend
[x] Install ClamAV on production systems with hourly signature updates
[ ] Schedule ClamAV to run scan nightly and email report via shell script OR via AWS runcommand
[ ] Production data access logs, including transmission (access via REST API). Ensure that these logs are persisted and not deleted after a period of time.
[ ] Log all instances of wireless access via SSH and via secure access to the production database (ssh log and mysql access log)
[x] Investigate why v2 and staging EBS backups happen at different times.
[ ] Configure logrotate to compress and keep all logs
[x] Fix logging error for performance monitoring log4j:WARN No appenders could be found for logger (net.bull.javamelody)
[x] Remove system actions from to /monitoring endpoint so the monitoring endpoint becomes read-only
[x] For Melody, move all credentials from System properties to environment variables to exclude from monitoring report to remove credential information from JVM args in System information section of Melody monitoring
[x] Weekly Java Melody reporting
[x] Daily OSSEC alerts summary
[ ] Centralize all logs through CloudTrail in an S3 with encryption at rest.

To be added to compliance calendar

[x] Schedule rotating all LastPass passwords in the compliance calendar, including master password
[x] Put monthly rotating IAM keys on the compliance calendar + expire old keys one day later
[x] Schedule testing restoring EBS snapshots
[ ] Schedule weekly checking-for and installing updates in systems (script this so it does it automatically?)
[x] Schedule checking that all physical media is encrypted at provisioning on a quarterly basis
[x] Schedule annual review of HIPAA compliance policy

Necessary new TextUp features

[ ] Implement TextUp password policy: prevent password reused, enforce changes after # days, minimum length, etc.
[ ] Automatic JWT session management and mandatory expiration of refresh tokens after one year.
[ ] Implement encrypted JWT functionality with minimum of 4096-bit RSA keys or keys/ciphers of equivalent or higher strength
[ ] Mandate temporary password and lock code change on account set-up
[ ] Ability to download TextUp data for an entire agency
[ ] Ability fo TextUp to remove previous Customer data

Bolster / bolster-team

TextUp last-mile to initial HIPAA compliance #75

To be added to compliance calendar

Necessary new TextUp features