United States
MedTech Diagnostics
A security assessment of a diagnostic desktop application used with the diagnostic platform, focused on protecting patient diagnostic data, strengthening application controls, and supporting the client’s FDA 510(k) documentation.
United States
MedTech Diagnostics
Infectious Disease
Rapid Diagnostic Solutions
Web + API + AWS
Connected Platform
FDA Compliance
Submission Preparation
The client needed an assessment capable of meeting regulatory expectations while giving its engineering team clear direction across the connected application environment.
A manual, human-led approach examined authentication and data-handling controls beyond automated scanning.
The assessment was structured around the client’s FDA compliance requirements.
The engagement supported the web, API, and cloud scope without requiring the client to narrow the assessment.
The process remained organised and transparent across all three technology layers, from scoping through delivery.
Qualysec brought the web application, API, and AWS environment into one coordinated review, giving the client a clear path from technical assessment to regulatory preparation.
MedTech focused
FDA-ready evidence
The review focused on authentication, authorisation, application handling, API access, and AWS storage permissions.
The password reset workflow was reviewed for weaknesses that could affect user account security.
Review focus: Authentication
The platform’s handling of stored content was assessed for unsafe execution paths.
Review focus: Application security
Application permissions were reviewed to ensure users could not move beyond their intended access level.
Review focus: Authorisation
Ownership checks were assessed around access to diagnostic information through API requests.
Review focus: API access
AWS storage configurations were reviewed to ensure diagnostic information was not broadly accessible.
Review focus: Cloud access
Weaknesses across authentication, authorisation, and cloud access could have created opportunities for unauthorised access to patient diagnostic information and increased security concerns during the FDA compliance review.
Qualysec worked alongside the client’s engineering team across the application, API, and cloud environment, providing remediation guidance and documentation aligned with FDA compliance requirements.
The password reset workflow was rebuilt to strengthen account recovery and verification.
Input handling was improved to prevent malicious content from being stored and executed through the application.
Role-based permissions and API ownership checks were tightened to restrict access to authorised users.
AWS storage permissions were reviewed and restricted to remove unnecessary access to diagnostic information.
The web application, API, and AWS environment were retested, with the completed work documented to support the FDA compliance submission.
Secure
Account Recovery
Authentication workflows reinforced
Controlled
Diagnostic Data Access
Application and API authorisation strengthened
Restricted
Cloud Storage
AWS permissions tightened
FDA
Compliance Support
Security documentation prepared
Get In Touch
Whether you are preparing any regulation or standards submission, testing a connected device, or assessing risk across a MedTech platform, we can start with a scoping call.
