More Security for Patient Data: Pentest and Cloud Audit at medavis
Case Study – IT-Security
written by: usd AG, Germany
Compliance requirements are often the driving force behind the necessity of a pentest. However, each company and its IT infrastructure has to be looked at individually. Usually the initially requested pentest is not enough. For example, if applications run in the cloud, other attack vectors need to be considered as well. A good example is the cooperation with medavis GmbH.
The Karlsruhe-based provider of radiology workflow solutions processes highly sensitive patient data, such as diagnostic images and medical findings, and thus places the radiology workflow at the center of its thoughts and actions. Due to the very high protection requirements of the processed data, medavis ordered a check of the IT security level of the entire cloud infrastructure in addition to the pentest. The usd security experts analyzed the configuration of the AWS cloud services and the applications running on it.
usd Experts have developed a special testing procedure, which is based on the specifications of the Payment Card Industry Data Security Standards (PCI DSS), the recommendations of the German Federal Office for Information Security (BSI) and the Open Web Application Security Project (OWASP), among others. Furthermore, benchmarks of the Center for Internet Security (CIS) and best practices of the cloud service providers are taken into account. Combining all those requirements as the basis of the usd approach increases the security of the tested systems in the long term.
Tobias Troesch, Product Owner at medavis GmbH, and his colleagues take information security very seriously:
“As a manufacturer of radiology workflow solutions, we provide the information flow of sensitive data for medical diagnoses. The protection of patient data is hence a top priority for us. Only this way, we can guarantee our customers the best possible security level. usd AG has supported us in a highly professional and competent way from the beginning. This was already evident in the initial consultation: In close collaboration, we defined the risk classifications of the various functions and thus received an excellent offer adapted to our needs in order to have the most efficient examination carried out. Taking also the configuration of AWS cloud services into consideration was an excellent approach from the usd specialist sales department at this phase. Overall, we would like to thank usd AG for the always pleasant and goal-oriented cooperation and competent advice – even beyond the actual project.”
Tobias Neitzel, usd Managing Consultant IT Security, about the specifics of the environment they have tested:
“The pentest of a cloud infrastructure is different from the traditional on-premise infrastructure test. Cloud provider such as AWS offer many features and a high degree of flexibility. This has many advantages for cloud users, but also entails security-related risks that should not be underestimated. Cloud providers therefore generally follow a model of shared responsibility: For example, the responsibility for configuring the servers and access rights lies with the user.”
“Companies usually focus on testing their application. In doing so, they often disregard the configuration of the cloud services themselves. It is very important for us to address precisely these points of attack in the initial consultation with our customers. medavis GmbH took exactly the right steps to achieve a higher IT security level by conducting a technical security analysis in the form of pentests as well as a configuration audit. We are looking forward to a continued partnership and cooperation.”, added Dr. Kai Schubert, Managing Consultant der usd AG.
Visit the medavis virtual booth @ ECR Online 2020 The ECR 2020 Online Summer Edition provides a chance to discover the latest and greatest in radiology technology.We look forward to meeting you virtually at our booth! Simply register for free for the ECR virtual...
Online Appointment Bookingwith booking4med automated, diburdening, close to the patientsMore Efficiency During Appointment Scheduling Scheduling appointments over the phone is a long established but labor-intensive process. Overloaded telephone lines often result in...
Interface to Dosage Management SystemsLean Processes due to an Optimal Integration into your WorkflowVarious dose management systems have been developed for the legally compliant implementation of radiation protection regulations in the medical context. To ensure that...
Do you have further questions or would like to get a demo?
Do not hesitate to contact us. We look forward to providing you with the necessary advice or to arrange a demo appointment with you, in order to present your optimal workflow.