Improved Security and Performance of a Healthcare Application in the US

Upon taking over this project, our top priority was to verify and ensure the overall quality and security of the entire system before proceeding with further product development. Through a detailed analysis, we were able to redefine our priorities and adjust them to align with the current state of the project.In addition to these measures, we involved the Security team in conducting a thorough review and followed rigorous protocols such as conducting performance testing, adhering to a production readiness checklist, and generating comprehensive documentation. This approach ensured maximum security and readiness prior to deploying our new Python backend.

/

Ensuring security for a product

From the initial stages of the project, our team's expertise was evident, and we were dedicated to ensuring that the client would not have to concern themselves with any security-related issues. To guarantee this, we took a thorough approach to designing the system, carefully considering all possible vulnerabilities and security requirements.

The app was required to undergo security reviews yearly due to HIPAA compliance regulations and planned entry into the EU market. This was because medical data and HIPAA regulations, along with entering the EU market, were forcing an increased level of security. In addition to functional requirements and non-functional requirements connected with privacy and confidentiality, it was essential to conduct regular security inspections.

Overcoming client challenges to secure sensitive digital products

The first step after taking over the project was to identify the level of security and potential issues. Following the Security team's analysis, it was discovered that the code of the client's application was poorly written, which left them vulnerable to potential security breaches. We took immediate action, informing the client of the situation and providing recommendations to mitigate any potential risks. As the client's app contained a significant amount of sensitive medical data, it was considered to be at a higher risk level.

During our analysis we were able identify several high severity vulnerabilities and take appropriate measures to safeguard against potential security risks. We also verified all logs and data to confirm that none of the vulnerabilities were exploited. We also advised the client to take their most vulnerable elements off the production environment to reduce risk of potential security incidents and fines , taking into consideration the high security requirements for HIPAA compliance and EU market entry plans, including potential GDPR compliance. By working proactively, we helped the client identify vulnerabilities and take appropriate measures to safeguard against potential security risks.

To mitigate these risks, our team conducted a comprehensive security assessment of the product, working closely with the client to identify weaknesses in the architecture, configuration, and access controls. We then recommended several measures such as penetration testing, threat modeling, and code review to strengthen the product's security.

Our proactive approach helped the client implement a more secure development process that safeguards against potential security risks while ensuring compliance with regulatory requirements.

Our proactive approach to mitigate security risks and safeguard users' data

After conducting a thorough Security audit, our Security Team presented their findings and recommended the following actionable steps:

• Take the production environment down immediately to prevent any further security risks.
• Remove any endpoints that allow access to user data and Shopify API credentials without authentication as they pose significant risks to data security.
• Remove any unused endpoints from the system.
• Prioritize fixing any remaining issues identified by our Security Team to minimize downtime and further reduce potential security risks.

By following these steps diligently, we were able to take appropriate measures to ensure the safety of users' data and mitigate any potential security threats.

Thorough product security engineering

As part of our service, we not only developed a highly secure and reliable backend, but also provided a performance testing service to ensure optimal data transfer rates and developed dedicated endpoints to manage the data transfer process seamlessly. We ensured the efficient and secure processing of large amounts of data, as users relied on the application for several years. Moreover, we have extended the scope of services to include product security engineering. The following is a list of services we provide in this regard:

Product Engineering

• Security analysis at the beginning and defining security requirements for the application.
• Repetitive penetration services on a yearly basis.
• Dedicated Security Engineer/Consultant as part of the project team to build new features according to the Secure-by-Design approach.
• Risk assessment and threat modeling.
• Design architecture hardening.
• Cloud config hardening.
• Vulnerability management.
• Ensuring compliance with technical security requirements.

By taking a thorough and thoughtful approach to the project, we ensured that the application was highly secure and efficient, meeting the demands required to serve users with diabetes. Our focus on security engineering ensures that the application is designed and built with security in mind from the start. This approach helps prevent security breaches and ensures that the application remains secure in the future.

Netguru's agile approach to improved system security

Netguru adopted a simple yet effective approach to improve their system's security while ensuring that business operations were not disrupted. Their solution involved building a new administration application with enhanced functionality and a new graphic design, which allowed them to leave the old administration panel behind.

At the same time, they incorporated product security engineering best practices to incorporate security requirements in an agile way. This enabled them to remove existing security issues, redesign the system's architecture, and implement security best practices in line with secure-by-design principles. By doing so, they were able to achieve their goal of improving system security without blocking the business.

A crucial aspect that contributed to the success of the project was implementing Product Security Engineering. We checked the legacy code thoroughly for security and defined security requirements at the beginning of the project. This approach ensured that security remained a top priority throughout the project, preventing security breaches and maintaining the application's secure architecture.