-
Cisco PCI Solution for Healthcare Design and Implementation Guide
-
Preface
-
Solution Overview
-
Solution Framework
-
Solution ComponentsBest Practices and PCI
-
Implementing and Configuring the Solution
-
Bill Of Materials of Devices for Branch
-
Data Center/Internet Edge Components and Versions
-
Application Protocols
-
Detailed Implementation and Configuration Steps
-
Device Configurations
-
Report on Compliance (ROC)
-
Glossary
-
Table Of Contents
Applications and Partner Services
Solution Framework
The PCI Solution for Healthcare architecture is based on Cisco 's Medical-Grade Network (MGN), a Service-Oriented Network Architecture (SONA). For more information on SONA and the MGN, refer to the following URL:
http://www.cisco.com/go/healthcare
The Cisco MGN provides the framework required to meet healthcare's unique needs for interoperability, security, availability and productivity. As shown in Figure 2-1, different reference designs serve as the foundation of the network systems layer, such as clinics and hospitals.
Figure 2-1 PCI Solution for Healthcare SONA Framework
Applications and Partner Services
The top layer of the SONA framework includes the applications and services that are part of the PCI solution, such as point-of-sale, payment, and encryption applications. Some of these applications use popular middleware services based on J2EE, .NET, or other systems. The shared network services approach allow these various Service-Oriented Architecture (SOA) environments to share the same infrastructure services across multiple network topologies. Annual audits, network scans, and remediation services are necessary services required to be compliant with PCI requirements.
Infrastructure Services
Process control is simplified by using common infrastructure services for security, mobility and identity, and management. These are key advantages that aid in operational reporting and the policy requirements of achieving PCI compliance. Fewer services that are shared across more intelligent devices increases the operational efficiency of the whole system.
•
Application networking services are the connection from the business applications to the shared services of the infrastructure services layer. This is where filtering, caching, load balancing and protocol optimization interact with applications or application middleware services to optimize the performance from the source of data to the end user. Application delivery services include server load-balancing and content filtering features performed by Cisco IOS routers or Cisco Application Control Engines (ACEs) .
•
•
•
•
•
•
•
Wireless systems are managed with the Cisco Wireless Control System (WCS). These systems include configurations, administrative elements, and security services.
RSA data security applications use specific management tools in this architecture. RSA file security manager manages file encryption services on hosts and servers with payment data.
Network Systems Layer
The network systems layer is where all resources are interconnected across a converged network transport infrastructure designed and tested with a set of modular architectural blueprints.
Path isolation is a key component of network virtualization. The PCI Solution for Healthcare isolates point-of-sale and network control traffic from other types of network traffic using VLANs, multiple WLAN SSID domains, and a private connectivity to the data center, where network management is centralized. The Enterprise Network Virtualization design guides cover additional techniques to isolate and protect sensitive traffic These design guides may be found at:
Network Designs
The following three designs are intended to address the deployment of a network infrastructure in different health facilities in order to achieve PCI compliance. These designs should also allow for future expansion and support for new applications in the Cisco Medical Grade Network.
Doctor's Office
The purpose of a typical doctor's office is to provide outpatient healthcare services and typically includes treatment rooms and laboratories. A doctor's office facility typically has less than eight physicians. The doctor's office reference architecture presented in this design guide provides the security required to transmit cardholder data while offering a compact form factor and the flexibility to expand the system if additional devices or services are required.
The scenario shown in Figure 2-2 meets the following requirements:
•
•
•
•
Figure 2-2 PCI Solution for Healthcare—Doctor's Office
This network architecture is widely used and consolidates many services into a few networking components. The Cisco ISR router provides security and can be expanded to support other services, such as an integrated Ethernet switch and an integrated content engine to support centralized application optimization and other application velocity services.
Advantages
•
•
•
•
Limitations
•
•
•
Medical Clinic
A medical clinic also focuses on providing outpatient healthcare services and typically has between 8 to 20 physicians. As more mission-critical applications and services rely on the IP infrastructure, network availability becomes more important. The reference architecture presented in this design guide offers an increased level of application availability and network resilience.
The medical clinic scenario in Figure 2-3 meets the following design requirements:
•
•
•
•
Figure 2-3 PCI Solution for Healthcare-Medical Clinic Network Design
The redundant Catalyst switches and Cisco ISR routers increase the availability of the medical clinic design. Each of the ISR routers is able to run IOS security services and other communication services simultaneously and is connected to a dedicated WAN connection. The Hot-Standby Routing Protocol (HSRP) is used to ensure network resilience in the event of a network failure.
Up to 12 wireless access points can be installed in the clinic (supported by the WCS controller as tested and without adding more controllers).
Advantages
•
•
•
Limitations
•
•
Hospital
The hospital scenario in Figure 2-4 meets the following design requirements:
•
•
•
•
•
Figure 2-4 PCI Solution for Healthcare—Hospital Network Design
The hospital reference architecture is based on several features from a traditional campus design. A hierarchical campus design approach has been widely tested, deployed, and documented. The goal of this design is to provide highly available and modular connectivity by separating buildings, floors, and servers into smaller groups. The network design should provide a level of redundancy where no points of failure exist in hardware components and allow for hardware to be swapped without interrupting the operation of devices.
Advantages
•
•
•
•
Limitations
•
•
Data Center
The data center is a central component of an IT architecture and provides the computational power and applications necessary to support healthcare services. Proper planning of the data center design is critical, and performance, resilience, and scalability need to be carefully considered. Figure 2-5 shows a typical healthcare data center design.
Figure 2-5 Typical Healthcare Data Center Design
For the purpose of this document, the data center is split into five areas: WAN aggregation, core, services aggregation, server access, and storage. In additional to these five areas, there is an alternative way in which a branch location such as a hospital can be connected to the data center. Instead of connectivity through a WAN, the hospital location is directly connected to the data center over an Ethernet-based campus.
The WAN aggregation architecture is based on the Infrastructure Protection and Security Service Integration Design for the Next Generation WAN Edge v 2.0:
http://www.cisco.com/application/pdf/en/us/guest/netsol/ns171/c649/ccmigration_09186a0080759487.pdf
The core, services aggregation, and server access tiers of the multi-tier data center architecture was based on the design documented in the Cisco Data Center Infrastructure Design Guide 2.5:
http://www.cisco.com/application/pdf/en/us/guest/netsol/ns107/c649/ccmigration_09186a008073377d.pdf
Primary Design Requirements
The data center design should meet the following requirements:
•
•
•
•
•
•
•
WAN Aggregation
The WAN aggregation layer is a transit network that aggregates the connections from the healthcare facilities, via a private or public service provider network. The WAN aggregation layer does not directly connect end users in the HQ, campus, or regional branches; rather, it provides connectivity for the healthcare facilities' LAN to connect to the data center core network and its resources.
The WAN edge devices are Cisco routers and should be dedicated to provide WAN connectivity and should not be used as Internet gateways for the data center. This recommendation is based on segmentation and typical throughput requirements for the healthcare WAN.
A dedicated firewall appliance is used to secure incoming WAN traffic and to terminate VPN connections to the clinics and hospitals. Many Cisco routers also support the IOS security software option which includes a firewall feature.
Cisco provides several network security devices dedicated to protect the data communication between the data center and the healthcare facilities. Figure 2-6 shows two main ways to provide security and connectivity to the clinics and hospitals. The Cisco ISR routers with the IOS security features provide an integrated security approach within a single device, but using dedicated security devices, such as the Cisco ASA and IDS/IPS appliances is also a common design that offers more granularity and scalability.
Figure 2-6 Data Center—WAN Aggregation Alternatives
Core
The core layer provides the high-speed packet switching backplane for all flows going in and out of the data center. The core layer provides connectivity to multiple aggregation modules and provides a resilient Layer 3 routed fabric with no single point of failure. The core layer runs an interior routing protocol, such as Open Shortest Path First (OSPF) or Enhanced Interior Gateway Routing Protocol (EIGRP), and load balances traffic between the campus core and aggregation layers using the Cisco Express Forwarding (CEF)-based hashing algorithms.
Services (Edge) Aggregation
The services aggregation layer modules provide important functions, such as service module integration, Layer 2 domain definitions, Spanning Tree processing, and default gateway redundancy. Server-to-server multi-tier traffic flows through the aggregation layer and can use services, such as firewall and server load balancing, to optimize and secure applications. The service modules provide services such as content switching, firewall, SSL offload, intrusion detection, network analysis, and more. Figure 2-7 illustrates a characterized view of the Cisco Catalyst 6500 switch aggregating service modules, such as firewall services, intrusion detection, load balancing, and others.
Figure 2-7 Conceptual Service Aggregation Layer
Server Access Layer
The server access layer is where the servers physically attach to the network. In typical data centers, the server components consist of 1RU servers, blade servers, and clustered servers. The access layer network infrastructure consists of modular, fixed configuration, and blade server switches. Switches provide both Layer 2 and Layer 3 topologies.
The network management servers connect to the server access layer in order to be segmented from other business application servers, and to be protected by firewall services from the service aggregation layer above. Business servers, consisting of POS transaction log servers, database, and data warehouse servers, would also exist at this layer but would be segmented via separate VLANs and firewall policy.
Storage
A combination of the file encryption provided by the RSA File Security Manager product, fiber-channel zoning, and Logical Unit (LUN) masking/zoning as provided by the Cisco family of multi-layer director switches (MDS) were used in the storage implementation of this solution to deliver encryption and restricted access to cardholder data at rest in the data center. By deploying zoning within a Fibre Channel fabric, device access is limited to devices within the zone. This allows the user to segregate devices based on access to a particular storage device (disk array). This is generally an absolute requirement when dealing with a data center environment in which multiple file servers in the data center server farm are connected to the same SAN fabric and access to cardholder data must be restricted to a subset of servers (see Figure 2-8).
Figure 2-8 Data Center Storage Area Networking
Advantages
•
•
•
•
•
•
Limitations
•
•
•
Internet Edge
This design takes into account best practices from the Data Center Networking: Internet Edge Design Architecture Design Guide (http://www.cisco.com/go/srnd/) and customizes these recommendations for a Healthcare Internet edge and extranet network.
The edges connects Internet services to the complete enterprise environment (i.e., from headquarters to Internet service providers (ISP), branch office connections that use Cisco secure VPN to connect to headquarters). The collapsed design provides highly centralized and integrated edge networks and transports the aggregated traffic through different service modules (Cisco ACE, Cisco FWSM, and Cisco IDSM2) within a pair of Cisco Catalyst 6500 switch chassis. The design also provides protection and defense against XML and OWASP Top Ten threats using the Cisco ACE XML Gateway.
The Internet edge solution architecture is shown in Figure 2-9.
Figure 2-9 Typical Internet Edge Architecture
The Internet edge provides the following security functions:
•
•
•
•
•
•
Primary Design Requirements
The Internet edge design meets the following requirements:
•
•
•
•
•
•
