Skip to content
Start a project

Securing MMC Hospital’s website, admin panel and APIs

A security audit of MMC Hospital’s website, admin panel, APIs and email domain, with fixes ranked by risk and a retest.

Get a security auditAbout the service
OWASP Top 10OWASP API Security Top 10CERT-In guidelinesDigital Personal Data Protection Act, 2023

The challenge

Why the hospital needed an audit

MMC Hospital runs several connected systems: a public website, an admin panel for staff and APIs that power its digital services. Each connection is a possible entry point.

The hospital also wanted to stop attackers from sending fake emails that appear to come from its domain, a common trick used against patients and staff.

Scope

What we audited

Every system below was tested with the hospital’s written consent and within agreed testing windows.

Website

Public pages, forms and content checked for common web vulnerabilities.

Admin panel

Login strength, user roles, session timeouts and protection against brute-force attacks.

APIs

Authentication, access control and data exposure on every endpoint.

Email domain security

SPF, DKIM and DMARC records reviewed to prevent spoofed emails.

Approach

How the audit was carried out

A clear, safe process that never put live hospital services at risk.

  1. 01

    Scope and consent

    Systems, accounts and testing windows agreed with the hospital before testing.

  2. 02

    Testing

    Automated scans plus manual testing of the admin panel and APIs.

  3. 03

    Reporting

    Findings ranked from critical to low, each with proof and fix steps.

  4. 04

    Retest

    Fixed areas were tested again to confirm the issues were resolved.

Standards

Tested against recognised standards

  • OWASP Top 10
  • OWASP API Security Top 10
  • CERT-In guidelines
  • Digital Personal Data Protection Act, 2023

Deliverables

What the hospital received

  • Executive summary for management
  • Technical report with evidence
  • Email domain hardening checklist
  • Retest report

Outcome

What changed for the hospital

Findings and system details stay confidential. This is the impact we can share.

Stronger admin access

Login and role settings reviewed so only the right staff reach sensitive tools.

Safer integrations

APIs checked so data is only shared with authorised apps and users.

Harder to impersonate

Email records reviewed to make spoofed hospital emails easier to block.

More case studies

Other security audits we have delivered

Security auditHealthcare

Sonoscan Hospital

A full security audit of Sonoscan Hospital’s website, online report access and hosting server, with a ranked fix plan and a retest.

Read case study
Security auditHealthcare

DRL Hospital

A security audit of DRL Hospital’s website, staff login portal, internet-facing servers and backups, with a ranked fix plan and a retest.

Read case study

Want the same level of protection?

Tell us which systems you want checked. We reply within one working day with a scope and a fixed quote.

Prefer email? twenovaitc@gmail.com