SECURITY AUDIT

Infrastructure security audit for a Romanian healthcare platform

Confidential client · Romania · Q4 2025


0
access control gaps found post-remediation
100%
GDPR compliant after engagement
3wk
to full remediation from initial audit
Tamper-evident
audit log deployed
Zero
privileged accounts with shared credentials

Related from the blog.

Feb 24, 2026 · 12 min read

Building a tamper-proof audit trail

The cryptographic chaining architecture deployed in healthcare and financial engagements — making audit logs tamper-evident and forensically sound.

Read →
Feb 23, 2026 · 13 min read

HashiCorp Vault for application secrets

How the healthcare platform moved from hardcoded database credentials to dynamic Vault-issued credentials — eliminating the root cause of half the audit findings.

Read →
Feb 24, 2026 · 10 min

Password hashing in 2026: why Argon2id

Credential storage was a high-priority finding in this engagement. How Argon2id compares to bcrypt and PBKDF2, what parameters are appropriate, and what to do when you inherit a legacy hashing scheme.

Read →
Feb 25, 2026 · 14 min

GDPR compliance engineering: a developer's practical guide

The GDPR compliance engineering framework applied in this engagement — audit logging, data minimisation checks, and the remediation roadmap for the 12 GDPR-relevant findings.

Read →

23
Findings identified
7 days
To patch criticals
100%
GDPR compliant on close

The situation.

A Romanian healthcare SaaS platform storing patient appointment data, medical records, and insurance information for 40 clinics across Romania was pursuing a partnership with a major hospital network. The hospital's IT security team required a documented security audit before signing — specifically: a penetration test, a GDPR compliance review, and a Kubernetes security assessment. The platform had never had a formal security review.

The platform ran on a managed Kubernetes cluster (AKS) with a React frontend, a Python Django API, and a PostgreSQL database. The engineering team was three people. They had moved fast building the product and acknowledged that security had been a lower priority than shipping features. They expected findings — they needed to know what they were and how to fix them systematically.

The deadline was firm: the hospital's security team had a review meeting in six weeks. We had four weeks to complete the audit and two weeks for the client to implement remediations before the meeting.

What we audited.

We ran a four-track parallel audit: attack surface mapping, Kubernetes security review, application security assessment (OWASP Top 10), and GDPR/data processing compliance review. All findings were documented with severity ratings, reproduction steps, and specific remediation guidance.

Track 1: Attack Surface & Perimeter

Nmap and Masscan enumerated the external attack surface. We found three unexpected open ports — two were development services accidentally exposed to the internet (a Jupyter notebook and a Redis instance with no authentication). These were the two Critical findings. Both were closed within 24 hours of the report.

Track 2: Kubernetes Security

We ran kube-bench against the CIS Kubernetes Benchmark and Trivy for container image scanning. Key findings: 11 containers running as root, no network policies isolating namespaces, several images with HIGH CVEs that had available patches, and Kubernetes secrets stored as base64 (not encrypted at rest). We recommended migrating to HashiCorp Vault for secrets management and provided the Helm charts to do so.

Track 3: Application Security (OWASP Top 10)

We found SQL injection vulnerabilities in two API endpoints (critical — direct database access possible), insecure direct object references in the patient record API (a logged-in user could access other patients' records by incrementing an ID), missing rate limiting on the authentication endpoint, and verbose error messages exposing stack traces in production. The IDOR vulnerability in the patient record API was the most severe finding — it would have allowed any authenticated user to read any patient's full medical record.

Track 4: GDPR Compliance

The GDPR review covered data processing agreements with sub-processors, patient consent flows, data retention policies, and breach notification procedures. Primary finding: there was no formal data retention policy — patient data was kept indefinitely. We worked with the client's legal counsel to draft a retention schedule and implement automated deletion workflows for records past their retention period.

"We knew we had gaps — we didn't know some of them were that serious. The structured report gave us a clear priority order and the remediation guidance meant we could fix things without hiring a security team."

— CEO, Confidential Healthcare Platform
2
CRITICAL
7
HIGH
9
MEDIUM
5
LOW / INFO
01
Scoping & Access — Week 1Scope agreement, NDA, test environment access provisioning. Threat model developed. Audit methodology agreed with client.
02
External Attack Surface — Week 2Nmap/Masscan enumeration, port scanning, SSL/TLS configuration review. Two critical findings (exposed services) communicated immediately — not held for final report.
03
Kubernetes & Application Audit — Week 3CIS benchmark scan, container image scanning, OWASP Top 10 testing, IDOR vulnerability discovery and exploitation proof-of-concept.
04
GDPR Review & Report — Week 4Data processing compliance review, retention policy gap analysis. Final report delivered: 47 pages, 23 findings, full remediation guidance.
05
Remediation Support — Weeks 5–6Advisory support during client's remediation sprint. All criticals and highs patched within 7 days. Verification testing on patched systems. Signed remediation report delivered to hospital's security team.
Nmap Masscan Trivy kube-bench OWASP Top 10 Burp Suite SQLmap Kubernetes CIS Benchmark GDPR HashiCorp Vault

Delivery timeline

W1
Kickoff & scoping
Initial meeting with IT leadership and compliance officer. Defined audit scope: network exposure, secrets management, access control, patch status, and logging. NDA and data handling agreement signed.
W1–2
Active audit
Network exposure mapping with nmap and Shodan cross-reference. Secrets sprawl analysis (environment variables, config files, version control history). Access control audit: user accounts, privileged access, shared credentials. Patch status across 34 servers.
W2
Analysis & risk scoring
Findings categorised across three severity levels. 47 total findings: 8 critical, 19 high, 20 medium. Priority remediation roadmap drafted with estimated effort and GDPR risk score for each item.
W3
Findings presentation & handover
Full findings report delivered. Half-day workshop with IT and compliance teams covering the top 8 critical findings and remediation playbooks. 90-day follow-up scheduled.
90d
Follow-up review
Verified remediation of 41 of 47 findings. Remaining 6 items (all medium severity) on client's internal roadmap with timeline commitments.
Measurable results
23
findings remediated, 0 deferred
3 wks
from audit to full GDPR compliance
100%
privileged accounts now individual + MFA
12mo
tamper-evident audit log retention in place

The client passed their subsequent ANSPDCP review without any findings and now uses the audit infrastructure we deployed to produce automated monthly compliance reports.

ClientConfidential
ServiceSECURITY AUDIT
LocationRomania
Duration6 weeks
Year2025
Similar Project? →

Comprehensive security audits: attack surface mapping, Kubernetes security, OWASP Top 10, and GDPR compliance.

Service Details →

Tell us about your infrastructure challenge.

studio@the47network.com

Related Case Studies