Security & Compliance
Evidence, not promises.
Hardening approach
The reference desktop runs the DISA STIG with GUI profile for RHEL 10, tailored for remote delivery and scanned with OpenSCAP: 417 rules pass with no open failures, and every rule not applied is documented with its reason. The same profile is now applied while the desktop image is built; on a booted image the only failures were the boot loader password, which provisioning now sets, and a test account. Next: an automated scan on every build.
- Done: profile applied and OpenSCAP report committed
- Done: documented, reviewed exceptions
- Done: profile applied during image build; next: an automated scan on every build
Identity and MFA
All access flows through Keycloak single sign-on. MFA (TOTP today) is enforced for every organizational account, and Keycloak is the only MFA authority; the guest demo is password-only and isolated. Phishing-resistant WebAuthn and FIDO2 security keys are next.
- Live: Keycloak federates Red Hat IdM, so staff sign in with organizational accounts, on the desktop too
- Live: group-based desktop assignment
- Live: sign-ins end after 30 minutes idle, at both the identity service and the desktop gateway, and single sign-on lasts at most 10 hours; an open desktop connection stays up until it is closed
Audit logging
Live: sign-ins (with source IP), administrative changes, and desktop connections are logged with who, what, and when. Next: session recording. Assistant actions will be logged when assistants exist.
- Live: session start, end, and source
- Planned: assistant inputs, sources cited, and outputs
- Planned: export to your SIEM
Evidence-driven change control
Every change to the platform is a commit with a changelog entry and its evidence: logs, checksums, and test results. Releases with attached scan results arrive with the image pipeline.
- Live: secret scanning on every commit, re-run by CI on every push; signed commits
- Live: test evidence recorded in the build log
- Rollback by snapshot on the live desktop; by image on image-built desktops
Data protection
Live: clipboard controls keep data inside the session, and the identity server is backed up every night, encrypted and off-host, with the restore procedure documented. Desktops installed from the image encrypt their disk, unlocked by the vTPM. Backups for desktop VMs are next.
- Live: copy-out from the desktop blocked; clipboard cleared after 5 minutes (live clipboard tests pending)
- Live: nightly encrypted, off-host identity backups
- Built: disk encryption on image-built desktops; next for the cluster nodes
- Next: desktop VM backups and scheduled restore drills
Access path
The only way in.
- User browserNo client install
- TLS reverse proxyTerminates HTTPS
- Guacamole gatewayKeycloak SSO + MFA
- Hardened desktopSTIG baseline
- Access
- Browser only, via Apache Guacamole
- Identity
- Keycloak SSO (OIDC)
- Directory
- Red Hat IdM, federated into Keycloak
- MFA
- TOTP enforced for organizational accounts; guest demo is password-only and isolated; WebAuthn / FIDO2 next
- Transport
- TLS at the edge, encrypted tunnel inward, WireGuard between cluster nodes, RDP over TLS
- Clipboard
- Copy-out blocked, clipboard cleared after 5 minutes (live tests pending)
- Backups
- Identity server backed up nightly, encrypted, off-host
- Network
- Outbound-only Cloudflare Tunnel, no open ports
- RDP / VNC
- Never exposed to the internet
- Baseline
- DISA STIG + OpenSCAP: applied to the reference desktop and at image build time
- Disk encryption
- LUKS on image-built desktops, unlocked by the vTPM; cluster nodes next
- Audit
- Sign-ins and connections logged; session recording next
HIPAA mapping
Technical safeguard mapping.
| Safeguard | LocumView control | Evidence |
|---|---|---|
| Access control§164.312(a) | Keycloak SSO; a personal directory account for every user; documented break-glass access; sessions end after 30 minutes idle and the desktop locks after 10. Desktops installed from the image encrypt their disk, unlocked by the vTPM. Gap: the cluster nodes and databases are not yet encrypted at rest | Mapping, break-glass procedure, STIG report |
| Audit controls§164.312(b) | Sign-in, administrative and connection history kept 90 days; auditd with the DISA STIG rule set on the desktop. Next: central log collection and session recording | Mapping, STIG and HIPAA scan reports |
| Integrity§164.312(c) | SELinux enforcing, only package-installed software may run, signed packages, file integrity checks, signed and CI-checked configuration; copy-out from sessions blocked | Mapping, STIG report |
| Person or entity authentication§164.312(d) | SSO with enforced MFA (TOTP) for every staff account; account lockout; WebAuthn / FIDO2 next | Mapping |
| Transmission security§164.312(e) | TLS at the edge, WireGuard between cluster nodes, LDAPS to the directory, RDP over TLS; desktop protocols never public | Mapping |
HIPAA compliance belongs to the organization that deploys and operates the platform, including administrative and physical safeguards and business associate agreements. The public demo holds no patient data and must not be used with it.