Scaling and enhancing data protection for web application data in accordance with PCI DSS, HIPAA/HITECH, FEDRAMP standards

Abstract

The increase in the number of information web resources is due to the development of technologies for interaction with information, accessibility and ease of use for the consumer, opportunities for automating business processes, saving resources and time for providing services for entrepreneurs. In this paper, an integrated approach is considered regarding the implementation of the mechanisms for solving the above problems in accordance with the requirements of the standards of PCI DSS, HIPAA / HITECH, FEDRAMP. An effective approach for integrating the Amazon S3 cloud storage into web applications written in the Java programming language is proposed. The step-by-step guide to web services implementation will not only effectively scale and protect product data, but also significantly extend the functionality of the web application, use internal analytical tools to monitor user activity, generate reports based on aggregated statistics. The step-by-step guide for integration of web services will not only allow effectively to scale and protect product data, but also significantly expand the functionality of the web application, to use internal analytical tools for monitoring user activity, to generate reports based on collected statistics. The mathematical model of the AES encryption algorithm, implemented in the Amazon cloud environment, is considered to explain the feasibility and relevance of its use. A graph of comparing the speed of the most current encryption algorithms based on the data obtained by conducting research on measuring the amount of time spent on encryption at different data volumes was constructed. This approach will allow software products to meet the requirements of the EU and FISMA data protection directives, improve data scaling by accessibility zones and regions, and enhance data protection through internal Amazon mechanisms such as access control, auditing, network firewall, server-side encryption and the encryption key management infrastructure.