Introduction:

Imagine you are a business responsible for conducting and managing the largest academic clinical research studies in the United States. It can become a daunting task rather quickly. You must develop applications that are quick to produce and are user friendly, yet highly secure. Considering that you need to protect the participants individually identifiable health information under the HIPAA privacy rule. If you do not follow these guidelines, you will be liable and financial penalties will be enforced for non-compliance. Lets refer to this client as Company X, they stands tall when making critical decision that are made with the end users in mind.

The goal:

Ensure that the confidentiality and integrity of the data and the study was not able to be compromised. Without pure data, the studies would be less accurate, and the organizations reputation will be on the line. Not to mention if a clinical research study’s data is compromised the Principal Investigator (PI) can be sent to prison if the higher powers believe it was done intentionally.

This anonymously clinical research institute has some of the best trained individuals in each related field involved and they take their clinical research very seriously. Giving 110% to each clinical study to ensure it is as accurate as possible. That is why we choose to do that same for them and provide our best efforts when testing the web applications for them. First, we gather as much intel as possible and then walk though the site like a typical user would. We call this activity threat modeling. Then we begin our actual vulnerability testing by running all kind of tools and test to find whatever vulnerabilities that may exist within the web app. We gather our finding information, and we do what we can to validate it. Finally, we create our report and present it to our customer.