Security Testing Paves the Way for Secure Expansion of Clinical Trial Platform With eRegulatory Module

Summary

A US healthcare technology provider offering an electronic clinical trial management platform was expanding its capabilities by acquiring an electronic Trial Master File (eTMF) solution. To integrate it safely without weakening the security posture and compliance of its existing Clinical Trial Management System (CTMS), the Client engaged INNERLUXES for independent security assessments. Across three phases — application pentests and AWS/Azure cloud security reviews — INNERLUXES helped the Client build a secure, well-governed foundation for the integration.

About the Client

The Client is a US healthcare technology provider offering an electronic clinical trial management platform.

The Challenge

To uphold the strong security posture and compliance of its existing CTMS and cloud infrastructure, the Client sought independent security assessments. Protecting sensitive clinical trial data was central not only to meeting HIPAA, FDA 21 CFR Part 11, and SOC 2 requirements, but also to reinforcing customer trust and reducing regulatory or reputational exposure. At the same time, the Client was expanding its platform through the acquisition of a regulatory documentation management solution (an electronic Trial Master File, or eTMF) and wanted to verify that this new system met the same security and compliance standards as its CTMS — so it could be integrated safely without undermining the confidence of its healthcare and life-sciences customers. The Client shortlisted cybersecurity vendors and commissioned INNERLUXES for its experience in enabling security and data privacy for healthcare software, specifically CTMS and eTMF.

The Solution

To ensure HIPAA compliance, INNERLUXES signed a Business Associate Agreement (BAA) with the Client before starting. The project comprised gray-box penetration testing of the Client's CTMS web app, an AWS and Azure infrastructure security review, and gray-box penetration testing of the acquired eRegulatory solution's web app and API. The activities were aligned with PTES, the OWASP Web Security Testing Guide, and NIST 800-115, and issues were classified according to OWASP Top 10 and OWASP API Top 10.

Phase 1: Gray-Box Pentesting of the CTMS Web Application

INNERLUXES performed gray-box penetration testing of the CTMS web application using credentials provided by the Client, within a controlled environment that had no impact on real trial data. The testers identified several severe vulnerabilities, including an SQL injection flaw — by exploiting it, they gained unauthorized access to the application's database and retrieved usernames and password hashes, demonstrating how an attacker could escalate the issue to compromise sensitive data and user accounts. Recommended fixes included:

• Apply secure coding practices to prevent direct injection of user input into database queries (SQL injection).
• Validate user input against strict, predefined formats and reject anything that fails, blocking client-side script injection and markup abuse.
• Apply HTML encoding to all user-supplied data before including it in web responses to prevent cross-site scripting.
• Disable weak cipher suites (e.g., CBC-based ciphers) in server TLS configurations to protect encrypted traffic from decryption in man-in-the-middle scenarios.
• Include anti-CSRF tokens in state-changing requests and configure the SameSite cookie attribute to prevent cross-site request forgery.

After the Client completed remediation, INNERLUXES conducted a re-test and confirmed the strong cybersecurity posture of the CTMS web application.

Phase 2: AWS and Azure Infrastructure Security Review

The AWS security review covered cloud storage, relational and NoSQL databases, and core networking. It revealed 10 security issues, with remediation measures such as:

• Enable MFA for all IAM users to reduce the risk of unauthorized account access.
• Restrict public access to RDS instances to reduce brute-force, SQL injection, and data-theft risks.
• Enable MFA Delete on S3 buckets to protect trial documentation and regulatory records from unauthorized or accidental deletion.
• Configure Network ACLs to restrict access to admin ports (e.g., SSH, RDP).
• Enable AWS Config to continuously track resource configurations for change control and audits.
• Enable Amazon GuardDuty for threat detection and alerting.
• Enable S3 versioning to retain historical versions and support recovery of overwritten or deleted documents.
• Enforce IAM password policies with 90-day expiration.
• Deactivate unused IAM credentials after 45 days.
• Enable VPC Flow Logs to monitor network traffic and detect abnormal access patterns.

The Azure security review covered virtual machines, cloud storage, managed SQL and NoSQL databases, Kubernetes clusters, and built-in security tooling. It identified 55 security issues, with suggested remediation including:

• Encrypt storage accounts and databases with Customer Managed Keys (CMKs) to protect sensitive clinical and regulatory data and support HIPAA, GDPR, and FDA 21 CFR Part 11 compliance.
• Encrypt all OS and data disks using CMKs to protect all storage at rest.
• Restrict public access to RDP, SSH, HTTP(S), and UDP traffic.
• Configure network access rules to deny access to storage accounts by default and allow only trusted networks (zero-trust).
• Set up logging and monitoring (NSG flow logs, storage logging, etc.) with a minimum 90-day retention for forensics and auditing.
• Enable MFA for all users.
• Restrict Azure AD portal and directory permissions (e.g., guest invites, app registration, admin portal access) to reduce insider risk.
• Set up Microsoft Defender for Containers and Azure App Service for vulnerability and anomaly detection.
• Enable activity-log alerts for firewall-rule changes, security-policy deletions, IP updates, and other critical changes.
• Enable secure data transfer and enforce SSL for storage and managed database services to protect data in transit.

The Client implemented stronger access controls, data protection, telemetry, and governance procedures — creating a secure landing zone for integrating the acquired eTMF into the core platform.

Phase 3: Gray-Box Pentesting of the Acquired eTMF's Web App and API

INNERLUXES performed gray-box penetration testing of the web application and API of the regulatory documentation management solution (eTMF), using user and admin credentials provided by the Client. The testers discovered five non-critical issues, including security misconfigurations and vulnerable JavaScript libraries, and recommended:

• Implement missing HTTP security headers to prevent clickjacking, block MIME-type sniffing, and enforce HTTPS.
• Update or replace outdated JavaScript libraries to close potential exploitation vectors.
• Avoid disclosing detailed software version information to limit reconnaissance opportunities.
• Add CAPTCHA protection to the support widget in the feedback form to prevent email abuse and spam.
• Renew expiring SSL certificates to maintain encryption continuity and avoid browser warnings.

The Client implemented the measures, which INNERLUXES verified with a re-test — ensuring the integration added new capabilities without introducing avoidable risks.

The Results

Across the CTMS, its AWS and Azure infrastructure, and the acquired eTMF, the assessments strengthened the Client's ability to:

• Detect and investigate incidents faster through improved visibility into network activity, system changes, and security events.
• Maintain HIPAA, FDA 21 CFR Part 11, and SOC 2 audit readiness with concrete evidence of access and change controls, encryption, and logging.
• Enhance cyber defenses, cutting the risk of data or user-account compromise.
• Limit insider risk and blast radius through tighter identity and admin boundaries, reduced public exposure, and retirement of stale credentials.
• Preserve data integrity and recovery options with safeguards that prevent silent tampering or irreversible deletion, enabling compliant retention, rollback, and dependable audit trails.
• Ensure a secure, well-governed cloud foundation for the clinical trial platform by eliminating vulnerabilities on both AWS and Azure.

Technologies and Tools

Wireshark, Metasploit, Nessus, Burp Suite, Acunetix, SSLScan, WhatWeb, Nikto, Nmap, DirB, Postman, jwt_tool, hashcat, SQLMap, cURL, Python, C, Perl.