Feasible to use FileMaker for FDA businesses?

[d94dsj]

Hi!

I have been asked by a client to find out if you can continue to use FileMaker in a business that will have very strict requirements. It's a reasearch company in the pharmaceutical/bio-informatics industry and they need to comply with FDA "rules".

I think I know FileMaker quite well after some years developing in it and I know that FileMaker has some very weak points when it comes to security, for instance. But I've never had so strict requirements on a system.

The system would have to comply with "FDA Computer Complience, 21 CFR Part 11", which I have not read fully, but some of the requirements are as follows:

* Authentication

[Kurt Knippel]

In this regard Filemaker is not a "system" as they are refering to it. Filemaker in an of itself will NOT do any of these things, any more than Word will or C++ wil.

What the FDA is considering a "system" is the application which you develop using Filemaker. So long as you develop with these requirements in mind, you will be able to accomplish all of them.

It is up to the developer to create the "system". Yes all of this CAN be done in Filemaker, it is really up to the developer to make sure that the system functions as needed.

[d94dsj]

quote:

---

In this regard Filemaker is not a "system" as they are refering to it. Filemaker in an of itself will NOT do any of these things, any more than Word will or C++ wil.

What the FDA is considering a "system" is the application which you develop using Filemaker. So long as you develop with these requirements in mind, you will be able to accomplish all of them.

It is up to the developer to create the "system". Yes all of this CAN be done in Filemaker, it is really up to the developer to make sure that the system functions as needed.

---

Thanks for your comments CaptKurt, but it was not quite what I was looking for. I'm fully aware that the "system" would be the application/solution that is designed with FileMaker, and not FileMaker itself. Although it's a bit comforting that *you* say it CAN be done in FileMaker, I still unfortunately have many doubts, since FileMaker has very limited support for many things when it comes to security and authentication.

That's why I wonder if anyone has designed such a system before, with these requirements.

I see many weaknesses:

The network traffic generated with FileMaker is not encrypted, so you would have to rely on link-layer encryption for that, which decreases performance.

The login system used by FileMaker is very weak, since it relies on passwords and not user names and passwords.

FileMaker does not have support for transactions, although I don't know if it will be needed.

But it would indeed be inspiring if I find out that it's doable in practice!

Daniel

[danjacoby]

Regarding your second (of three) concerns, in addition to the password system, you can also have a main layout where users must enter a username and userpassword -- which compares their entry to a related FMP file with the complete list. You can even add a check (using Groups) to ensure that the username entered has access allowed by the Groups determined by the original password.

Ah, what a tangled web we weave...

[Steven H. Blackwell]

Without in any way commenting on the 21 CFR 11 debacle, let me restate something I have said here before regarding so-called User Front End Log On Systems.

Whatever other purpose these systems may serve, added security is almost never one of their results. In almost every instance, the use of such systems is rather easily bypassed.

I recommend your viewing the Windows Academy-Mac Academy CD on FileMaker Pro Security for a demonstration of the by-passing of several of these systems. And I apologize to these fine gentlemen for posting a commercial message on their bulletin board. But since this board does not display QuickTime videos, I can't show this.

Old Advance Man

[danjacoby]

quote:

---

Originally posted by Old Advance Man:

...a demonstration of the by-passing of several of these systems.

---

Are you saying it shows how to bypass the basic FMP password system, or just bypassing developer-created systems?

[Steven H. Blackwell]

I was responding specifically to the suggestion that the questioner employ a "custom" system.

Old Advance Man

[danjacoby]

quote:

---

Originally posted by Old Advance Man:

I was responding specifically to the suggestion that the questioner employ a "custom" system.

Old Advance Man

---

Ah.

In that case, I agree -- "custom" systems are much easier to hack than the built-in password system. Unless, of course, one programs the custom system very (and I mean VERY) carefully.

[Kurt Knippel]

quote:

---

The network traffic generated with FileMaker is not encrypted, so you would have to rely on link-layer encryption for that, which decreases performance.

---

Well, not to nitpik, but encryption was not on your list of requirements. That aside, ANY encryption scheme will degrade performance, no matter how or by whom it is implemented. Some other development platforms may have this built-in, but then the performance specs already take this into account.

To my knowledge developing in Oracle or C++ do not automatically grant encryption either. So no matter what you do, if encryption is a requirement, you will have to implement it into the system.

quote:

---

The login system used by FileMaker is very weak, since it relies on passwords and not user names and passwords.

---

This is partially because the "login system" in Filemaker is not a "login system". It is simply a password to prevent unauthorized access to the database and to allow the assignment of certain basic privledges. Most other RDBM systems do the same thing, simple password for access, it is up to the developer to implement the actual login system.

The developer with either need to build or buy and integrate an actual "login system".

quote:

---

FileMaker does not have support for transactions, although I don't know if it will be needed.

---

Filemaker is NOT a transactional based system, so it is not so much that it does not support transaction, as it does not use transactions at all.

Again transactional processing was not one of the stated requirements, but I know that many people have implemented this kind of approach within Filemaker. I have done so as well for various reasons. However transactional processing is not necessarily the best approach, so I do not bother with it unless I have no other choice.

quote:

---

But it would indeed be inspiring if I find out that it's doable in practice!

---

Everything you mention is doable. Has anyone ever done this specific type of thing? I do not know, but nothing that you mention is outside the realm of possibility.

Now I would not expect that this will be inexpensive, no system that can meet government requirement is. But it still should be less expensive than a comparable Oracle or C++ solution.

[d94dsj]

>>CaptKurt

quote:

---

Well, not to nitpik, but encryption was not on your list of requirements.

---

Read the following sentence again: "The system would have to comply with "FDA Computer Complience, 21 CFR Part 11", which I have not read fully, but some of the requirements are as follows: ...". Unfortunately, I don't yet have the full list of requirements, only some. So I'm taking a "paranoid" approach.

quote:

---

That aside, ANY encryption scheme will degrade performance, no matter how or by whom it is implemented. Some other development platforms may have this built-in, but then the performance specs already take this into account.

To my knowledge developing in Oracle or C++ do not automatically grant encryption either. So no matter what you do, if encryption is a requirement, you will have to implement it into the system.

---

Quite true. But it's a bit harder to do it in with FileMaker, since you cannot (to my knowledge anyway) configure the port that FMP / FM uses. Of course, if it is feasible to run a VPN solution at the clients' site, that doesn't matter.

quote:

---

This is partially because the "login system" in Filemaker is not a "login system". It is simply a password to prevent unauthorized access to the database and to allow the assignment of certain basic privledges. Most other RDBM systems do the same thing, simple password for access, it is up to the developer to implement the actual login system.

---

You are wrong. Most SQL databases Oracle, MS SQL, MySQL e.g. does have both username and password before granting access. And in many cases, there is support for a fine granularity of user access.

That said, it still takes a lot of time to implement access privileges, independent of system. I just mean that the basic structure within FileMaker is unfortunately weak.

Thanks for your input, CaptKurt.

>>OAM

quote:

---

Without in any way commenting on the 21 CFR 11 debacle, let me restate something I have said here before regarding so-called User Front End Log On Systems.

Whatever other purpose these systems may serve, added security is almost never one of their results. In almost every instance, the use of such systems is rather easily bypassed.

---

Thank you for the info. I'll look into those CD-ROMs if they're easy to order from Sweden.

Daniel

[BruceJ]

I work with FMP in hospital/medical record settings and have to comply with some rediculous HIPA requirements (thanks Clinton).

The way around the network security is to use Citrix and keep you FMP server and Data behind a secured server only accessibel to Citrix. Then let Citrix and NT or 2000 deal with the network security issues.

As far as the log on, you'll have to create your own user logon and a fairly complicated set of user preferences that are integrated into most every script that will determine what preferences allow and what they don't. This is a bit of a pain and needs to be designed this way from the ground up.

The part about tracking every users change is quite another problem. It requires some sophistocated and somewhat taxing scripts that will log the old data that is replaced by the new along with who did what when. 'Sounds do-able until you start to dig into it and it becomes a real pain in the butt. You end up spending 3/4 of your database time meeting all these parameters that may or may not be important in the long run.

[d94dsj]

Bruce, thanks for your input.

I can understand that it's a hard time to implement all of this. That's one worry I have...

Daniel

[bbaliner]

Daniel,

You're correct that large SQL databases support both username and password access. Username in FMP is on the "honor system", relying on the user to type it in Preferences. It isn't for security at all.

As for transactions, do you mean like transactions in MS SQL Server type of deal? Then it would be a batch, and every script would be a transaction. Unless you mean something else.

Additionally, there is a transaction log for FMS when on NT, (not sure for MACs).

Scol