Unumed Case Study - TechMagic

About the Project

Unumed's Hospital Management System offers EHR, full financial management, telemedicine, specialist information systems, AI, real-time analytics and much more, all in one complete system. Unumed HMS is the world’s only true cloud native HMS, bringing the unprecedented performance that you have been waiting for.

Unumed Business Goal

Unumed needed to ensure its cloud-native hospital management system remained secure and fully compliant with ISO 27001 requirements. Their business goal was to protect patient data and guarantee uninterrupted operations across multiple regions—

including Africa, SE Asia, and Central America—while maintaining trust among healthcare providers and patients. By testing their security posture, they aimed to uphold credibility in a competitive global market and prepare for the annual ISO 27001 audit.

001

Ensure data security and compliance with ISO 27001

002

Maintain uninterrupted operations across multiple regions

003

Uphold credibility and trust in a competitive market

Core Security Challenges in Healthcare

Unprotected Patient Data

Improper data handling during storage, transmission, or processing increases the risk of exposure and misuse. It may also risk non-compliance with ISO 27001, HIPAA-equivalent standards, and local regulations.

Weak Authentication Mechanisms

Role-based access controls for various users (doctors, nurses, administrators) might be insufficient, allowing unauthorized access to sensitive information.

Vulnerable API Integrations

APIs and third-party integration points, including laboratory systems and IoT devices, might contain security flaws compromising data exchange.

Misconfigured Cloud Settings

Insecure configurations such as overly permissive IAM roles or exposed storage buckets may leave critical cloud resources at risk.

Low Resilience Against DoS Attacks

The system might be vulnerable to denial-of-service attacks, which could disrupt critical hospital operations.

Objectives Set for This Project

Assess the risk of attacks on the application

Identify if a remote attacker could penetrate application defenses.

Determine the impact of a security breach

Examine whether breaches can lead to assessing the confidentiality of the company's private data, the availability and integrity of its application infrastructure, and the confidentiality of user information.

Find web applications vulnerabilities

Identify web application vulnerabilities that could lead to unauthorized access to sensitive data, application crashes, exploitation of vulnerable third-party components, or malware campaigns targeting users, which could result in spear-phishing or social engineering attacks.

Find privilege escalation vulnerabilities

Identify and exploit security weaknesses that could allow a user with limited privileges to access sensitive data, organizational confidential information, backup files, etc.

Services Delivered

We conducted a targeted black-box test on the primary web application, focusing on the OWASP Top 10 vulnerabilities, such as SQL injections and cross-site scripting while confirming the reliability of authentication and authorization mechanisms.

We evaluated the security of associated APIs and web services, looking for misconfigurations or exposure points that could jeopardize patient data or system operations.

Findings were compiled into a comprehensive report. This included a detailed risk analysis prioritizing vulnerabilities based on exploitability and the likelihood of affecting patient data and operational uptime. We also analyzed business impact, highlighting how these issues could influence compliance and everyday activities. We provided precise remediation recommendations aligned with ISO 27001.

The engagement concluded with a final presentation to review key vulnerabilities and next steps, ensuring that all technical teams and decision-makers clearly understood the results.

Work approach

Our approach was aligned with industry standards, including the Penetration Testing Execution Standard (PTES) and the OWASP Testing Guides. The testing began with a reconnaissance phase where testers collected publicly available information to simulate an attacker gaining initial knowledge about the target.

The actual testing was executed in phases:

Automated Scanning.

Deploying automated tools to discover common vulnerabilities.

Manual Testing and Exploitation.

Manual testing was crucial for deeper insights, particularly in complex authentication mechanisms and custom-built APIs.

Simulated Attacks.

Real-world attack scenarios were simulated to test the system's resilience against sophisticated attacks.

Each test was conducted in an isolated environment to prevent any actual impact on the client's operations. Our testers operated under strict confidentiality and integrity guidelines, ensuring that all findings were securely reported.

Our Team

Ihor Sasovets

Lead Security Engineer

Ihor is a certified security specialist with experience in penetration testing, security testing automation, cloud and mobile security. OWASP API Security Top 10 (2019) contributor. OWASP member since 2018.

Victoria Shutenko

Security Engineer

Victoria is a certified security specialist with a background in penetration testing, security testing automation, AWS cloud. Eager for enhancing software security posture and AWS solutions

Denys Spys

Associate Security Engineer

Denys is a certified security specialist with web and network penetration testing expertise. He demonstrates adeptness in Open Source Intelligence (OSINT) and executing social engineering campaigns. His wide-ranging skills position him as a well-rounded expert in the cybersecurity industry.

Roman Kolodiy

Director of Cloud & Cybersecurity

Roman is an AWS Expert at TechMagic. Helps teams to improve system reliability, optimise testing efforts, speed up release cycles & build confidence in product quality.

Common Tools We Use

Our security testing arsenal is stacked with cutting-edge tools implementing in different areas like AI in cybersecurity that enable us to identify vulnerabilities in third-party dependies with static analysis tool such as Semgrep, enforce code standards, and fortify your defenses.

OWASP ZAP

Burp Suite

Arachni

SonarQube

Semgrep

Snyk.io

Maltego

SpiderFoot

Nmap

Wappalyzer

Kali Linux

Parrot Security

OWASP ZAP

Burp Suite

Arachni

SonarQube

Semgrep

Snyk.io

Maltego

SpiderFoot

Nmap

Wappalyzer

Kali Linux

Parrot Security

OWASP ZAP

Burp Suite

Arachni

SonarQube

Semgrep

Snyk.io

Maltego

SpiderFoot

Nmap

Wappalyzer

Kali Linux

Parrot Security

Project Outcomes

Our assessment confirmed the client's strong security posture and revealed no critical or high-severity vulnerabilities. We only identified low to medium-severity issues related to access controls and data validation. Addressing these concerns required straightforward updates, and we collaborated closely with the client to suggest a series of targeted improvements.

The enhanced security controls minimized the likelihood of unauthorized access and data breaches and ensured compliance with ISO 27001 and security best practices.

Furthermore, our approach emphasized a balance between security and operational efficiency. By focusing on targeted improvements and risk-based prioritization, we helped the client avoid costly system overhauls and disruptions to their everyday operations.

The implemented solutions were designed to be scalable and adaptable to the client's evolving needs, ensuring long-term effectiveness and a sustainable security posture.

Get a quote

Why Choose TechMagic For Penetration Testing

Certified security specialists

With certifications PenTest+, CEH, eJPT and eWPT, our team possesses deep expertise and technical skills to identify vulnerabilities and simulate real-world attack. We provide cloud penetration testing, wireless penetration testing, social engineering testing, mobile and web application penetration testing, API penetration testing, external and internal network pen testing.

001

/003

Security and compliance

002

/003

Proven track record

003

/003

Cases that may be of interest to you

Quizrr

Internal Audit of the Information Security Management System

Coach Solutions

Web application penetration test

Let’s safeguard your project

Ross Kurhanskyi

VP of business development

Software Development

Security Services

Cloud Services

Other Services

Software Development

Web Development

Frontend Development

Backend Development

MVP/PoC Development

SaaS Development

Legacy Modernization

Digital Transformation

Security Services

Cybersecurity Services

Penetration Services

Managed Services

ISO Consulting

SOC2 Consulting

Virtual CISO

Social Engineering

DevSecOps Services

Cloud Services

Cloud Implementation

Azure Consulting

Google Cloud Consulting

AWS Consulting

Other Services

Discovery Phase

UI/UX Design

AI Intelligence

Test Automation

Data Engineering

CTO-as-a-Service

Salesforce Development

Healthcare App Development

Hospitality Transformation

Financial App Development

Marketing App Development

HR App Development

About Us

Client Testimonials

FAQs

Dedicated Development Team

Remote R&D Center

Fixed Price Software Development

our brands

Jobs (We are hiring!)

About career at TechMagic

Social Package & Benefits

TechMagic Academy

Blog

Top Tags

White Papers

Popular white papers

Webinars

Popular webinars

Unumed

About the Project

Unumed Business Goal

Ensure data security and compliance with ISO 27001

Maintain uninterrupted operations across multiple regions

Uphold credibility and trust in a competitive market

Core Security Challenges in Healthcare

Unprotected Patient Data

Weak Authentication Mechanisms

Vulnerable API Integrations

Misconfigured Cloud Settings

Low Resilience Against DoS Attacks

Unprotected Patient Data

Unprotected Patient Data

Weak Authentication Mechanisms

Weak Authentication Mechanisms

Vulnerable API Integrations

Vulnerable API Integrations

Misconfigured Cloud Settings

Misconfigured Cloud Settings

Low Resilience Against DoS Attacks

Low Resilience Against DoS Attacks

Objectives Set for This Project

Assess the risk of attacks on the application