“For us, data security is not merely a technical obligation, but also an expression of medical respect and care towards every person who places their trust in us. Only by setting the highest standards in IT security can digital transformation truly contribute to the well-being of the population and build trust in public healthcare. That is why we make no compromises when it comes to data security and data protection, and are setting new standards for secure digital health services.”
FRANKFURT AM MAIN PUBLIC HEALTH AUTHORITY | MAXIMUM SECURITY FOR DIGITAL HEALTH PLATFORM
Frankfurt am Main Public Health Authority sets new standards in IT security with iteratec
Penetration testing as a go-live criterion
IT security standards were implemented throughout the platform’s development process. The aim was to create a modern yet trustworthy solution for nationwide use in public health authorities. The concluding penetration test represented the final hurdle and ultimately determined whether the platform could go live.
The independent audit carried out by iteratec was intended not only to demonstrate the effectiveness of the security mechanisms, but also to show that a forward-looking approach to security is possible within the public sector.
Vulnerabilities identified, security strengthened
Penetration testing that makes a difference
The penetration test revealed areas for improvement. Even a robust security framework can still harbour vulnerabilities. For example, configuration flaws were discovered in the IAM system that would have allowed unauthorised access. These vulnerabilities were rectified before the launch, and the subsequent retest confirmed that the platform meets high standards of information security and data protection.
From optimisation to awards
The insights gained were used not only to optimise the application, but also to prepare for a planned certification. At the same time, they helped to establish modern concepts such as cloud-native architecture and zero-trust principles within the public sector – a genuine leap forward in innovation, which was recognised with the InfoSec Impact Award from NExT e.V. and the Federal Office for Information Security (BSI).
Security as the cornerstone of digital health solutions
The collaboration between the Frankfurt am Main Public Health Authority and iteratec serves as a prime example of how IT security is becoming a key factor in the success of digitalisation in the public sector. A comprehensive penetration test, bespoke testing procedures and open communication eliminate potential vulnerabilities and establish sustainable security standards.
The GA-Lotse is a pioneering project for modern administrative platforms and demonstrates the successful implementation of security concepts such as Zero Trust in public sector IT.
- In-house developed open-source tool kcwarden
- BurpSuite Professional for penetration testing
- Scout Suite for the cloud component
- A combination of automated scans and manual testing to ensure high cost-effectiveness whilst maintaining high quality
- Cloud Configuration Check
- Web Application Penetration Test
- Keycloak Security Test
The Frankfurt am Main Public Health Authority offers a wide range of services aimed at providing advice, promoting and protecting public health.
