Web Application Security in Digital Health: A Dual Analysis and a Context-Aware OWASP-Based Tool Proposal

Area of Science:

• Cybersecurity in healthcare
• Digital Health (DH) technologies
• Application security standards

Background:

• Rapid adoption of digital technologies in healthcare increases cybersecurity risks.
• Web applications in healthcare handle sensitive data, necessitating robust security measures.
• Regulatory compliance and data breach prevention are critical concerns.

Purpose of the Study:

• To investigate the applicability of Open Web Application Security Project (OWASP) guidelines in the healthcare domain.
• To identify common security requirements in Digital Health (DH) technologies and their alignment with OWASP Application Security Verification Standard (ASVS).
• To address the gap between security standards availability and their practical implementation in healthcare IT.

Main Methods:

• Literature review to identify DH security requirements and assess alignment with OWASP ASVS.
• Questionnaire survey distributed to Italian healthcare facilities and IT companies.
• Analysis of survey responses to identify knowledge and usage gaps of security standards.

Main Results:

• Common security requirements in DH technologies were identified and mapped against OWASP ASVS.
• A significant gap was observed between the availability of security standards and their practical application in the healthcare sector.
• Healthcare IT professionals and developers show limited awareness and utilization of existing security guidelines.

Conclusions:

• OWASP guidelines are relevant but underutilized in the healthcare sector.
• A context-aware tool is proposed to guide developers and testers in applying OWASP standards effectively.
• The tool aims to facilitate practical adoption of security best practices in clinical environments through tailored recommendations and checklists.