Our annual pen test keeps Bosman's healthcare portals secure

Thanks to the extensive reporting from Acknowledge's pen test, Bosman continuously optimizes its healthcare portals.

Medical device expert Bosman (formerly OneMed) offers healthcare professionals advice and support through their websites. They provide healthcare organizations with the right devices for diabetes, wound care and incontinence, among others. Bosman holds certifications for the International Organization for Standardization (ISO) and Dutch Standard (NEN). As a result, their services meet high standards for such things as cybersecurity and social commitment. One of the requirements is the annual performance of pen tests for all online portals. As Bosman's security partner, Acknowledge has been performing these pen tests for a number of years. Recently, this cooperation was extended for another three years. "We have good experiences with Acknowledge. Especially the depth in the reports fits well with our wishes and needs," says Mattijs Jonkers, security and IT officer at Bosman.

Penetration test

Bosman has a pen test performed every year by Acknowledge. During such a penetration test, a security expert checks how sensitive an organization's systems are to external digital attacks and whether there are vulnerabilities in the underlying infrastructure. Mattijs: "We build our websites ourselves, so we find it important that an independent party checks whether everything meets the requirements. It is also a review of our development department for us." This year, in addition to the ten customer portals, two corporate websites were also tested. Acknowledge compiles all vulnerabilities found in a comprehensive report. "Our developers then go to work to solve those vulnerabilities," Mattijs says. "During the ISO and NEN audits, we can always clearly demonstrate what was found and what we subsequently did with it. Very valuable!"

The greybox test

You can approach pentesting in several ways. Security consultant Philip van Roeijen explains: "At Bosman we opted for the greybox test. Here you receive information in advance from the customer about the websites you need to test. Because we know in advance what we are going to test, Bosman also knows for sure that we check everything." A pen test can sometimes be quite aggressive, causing the client to experience delays or even a website to go down completely. Therefore, there is careful coordination when the tests are performed. "Bosman's websites are used to order medical devices, you have to handle that carefully. That's why we always carefully coordinate what we are going to work on. In the end, Bosman didn't notice anything," Philip says.

Reports and retesting

For Bosman, the reports generated from the pen tests are very valuable. Mattijs: "The extensive report with clear descriptions and possible solutions gives us the tools we need to implement the improvements as well as possible. We put all the outcomes we need to follow up on in our ticket system, so we can keep the list up to date ourselves." Nowadays, Philip also conducts retests to retest the points found after a few months after the improvements have been implemented. "It makes sense to focus on the most significant findings so we can verify that the measures Bosman has implemented have been effective," he explains. "That retest is also a stick for Bosman to work on any outstanding vulnerabilities."

Fast switching

Philip has enjoyed working on the pen tests for Bosman. "Nice to contribute to the security of an organization that is so committed to people's care. The contact with Mattijs was also good. I could always go to him or a colleague if I had questions. Because we switch frequently and quickly, Bosman was already aware of the most important findings before the report. Then it doesn't come as a shock to them," says Philip. Mattijs agrees: "We agree well what and when we pen test. During the pen test we have weekly consultations about the progress, but Philip also regularly comes on the air when he has found something. That works nicely for us. And we are very happy with the comprehensive reports. I therefore rate the cooperation with an 8.5!"