Implementing a Secure CI/CD Pipeline for Verifiable Trust in a Federated Health Data Network.

Area of Science:

• Computer Science
• Health Informatics
• Cybersecurity

Background:

• Software supply chain attacks pose significant risks to the integrity and trustworthiness of Federated Health Data Networks.
• Establishing verifiable trust is paramount for secure data sharing in healthcare infrastructures.

Purpose of the Study:

• To design and evaluate a secure Continuous Integration/Continuous Deployment (CI/CD) pipeline for the German AKTIN Data Warehouse.
• To enable independent verification of software integrity within federated health data environments.

Main Methods:

• Implementation of a secure CI/CD pipeline generating digital signatures, Software Bill of Materials (SBOMs), and provenance attestations.
• Conducting a baseline assessment to evaluate the pipeline's effectiveness and identify software vulnerabilities.

Main Results:

• Successfully generated signatures, SBOMs, and provenance attestations for software components.
• Identified 264 high-severity vulnerabilities, predominantly within legacy software components.
• Demonstrated the pipeline's capability to produce essential security artifacts.

Conclusions:

• The developed secure CI/CD pipeline provides a transferable model for enhancing security in federated health infrastructures.
• The approach strengthens verifiable trust by enabling independent software integrity checks.
• Proactive vulnerability identification is key to mitigating risks in health data networks.