As part of our ongoing commitment to enhancing security across essential public sector systems, our team at SolDevelo conducted a thorough penetration testing of OpenLMIS.
This post takes you through our approach, the key areas we focused on, and how our findings helped the OpenLMIS team enhance the security of their platform.
OpenLMIS
OpenLMIS is an open-source platform designed to optimize supply chains for health commodities, particularly in low-resource settings. It plays an essential role in managing the distribution of life-saving medical supplies such as vaccines, medications, and diagnostic tests, improving data accuracy and accountability. With such high stakes, ensuring the platform’s security is crucial.
The Challenge
OpenLMIS handles sensitive data, and therefore is a potential target for cyberattacks that could disrupt operations, compromise patient care, or expose personal health information. With that in mind, our objective was to, throught penetration testing, uncover any weaknesses, assess how secure the platform was from both external and internal threats, and provide actionable recommendations to strengthen its defenses.
To achieve this, we first needed to gain a comprehensive understanding of the system and pinpoint the areas most susceptible to potential threats. Armed with this insight, we were to conduct a series of targeted tests, designed to evaluate the platform from multiple angles and ensure no vulnerabilities were overlooked.
The Solution: Testing process & our methodology
Securing a complex platform like OpenLMIS requires a structured, methodical approach. We divided the penetration testing process into distinct phases, ensuring a comprehensive evaluation across every critical part of the system.
Planning and reconnaissance: Understanding the system
Before we start poking at the system, we need to understand how it works. In the planning phase, we conducted a deep dive into OpenLMIS’s documentation, focusing on the platform’s architecture, key workflows, and data flows. This foundational step was critical for mapping out which components – such as login protocols, profile management, and data handling – were most crucial to test.
By gathering detailed information about how the platform operates, we could tailor our testing strategy to focus on areas that presented the highest security risk, like user authentication, session management, and sensitive data protection.
Automated scanning: Fast detection of known vulnerabilities
Next, we leveraged automated vulnerability scanning tools to quickly detect common issues. Using industry-standard tools such as OWASP ZAP, we scanned OpenLMIS for vulnerabilities, checking for weaknesses in its web applications, APIs, and data storage layers.
Automated scans are excellent for quickly identifying widespread security problems like missing security headers or outdated software libraries. However, automation alone isn’t enough, which is why we combine it with manual testing for a deeper exploration of potential risks.
Manual testing: Probing for deeper vulnerabilities
Manual testing is where we push the limits – exploring how attackers could exploit the system in ways that automated tools can’t always detect. This phase involved simulating real-world attack scenarios, focusing on areas such as session management, password policies, and user account controls.
By manually inspecting components like login processes and API endpoints, we were able to uncover vulnerabilities that might not be immediately apparent, such as weaknesses in authentication mechanisms or gaps in how data was stored and transmitted.
System configuration review: Checking for misconfigurations
The strongest code can still be compromised by weak system configurations. During our configuration review, we focused on server settings, network configurations, and security headers. This step was vital to ensure that OpenLMIS was operating in a secure environment, free from common misconfigurations that could expose sensitive data or open up attack vectors.
For example, we checked for the proper use of security headers like Strict-Transport-Security (HSTS) and Content-Security-Policy (CSP), ensuring that these essential safeguards were in place to protect the system from attacks like clickjacking and cross-site scripting (XSS).
The Results: Strengthening OpenLMIS’s security
While we won’t dive into specific vulnerabilities, here’s an overview of the key areas where improvements were made based on our recommendations:
Improving authentication and account security
One of the most critical aspects of any system is its authentication process. Our assessment focused on ensuring that OpenLMIS’s authentication protocols were robust enough to withstand attacks like brute force and credential stuffing. We recommended enhancements to their password policies and the introduction of multi-factor authentication (MFA), both of which add essential layers of protection for user accounts.
By implementing stronger account lockout mechanisms and rate-limiting features, OpenLMIS significantly reduced its exposure to credential-based attacks, ensuring that user accounts were better protected from unauthorized access.
Hardening system configurations
Misconfigurations can create unintentional vulnerabilities, so it was vital to ensure that OpenLMIS’s systems were configured according to best practices. Our tests revealed opportunities to improve network configurations.
We worked closely with the OpenLMIS team to implement changes that would mitigate risks like man-in-the-middle attacks and session hijacking, ensuring that sensitive data was encrypted and that access points were properly secured.
Securing data handling and storage
Handling sensitive healthcare data requires special care, especially when it comes to how data is stored and transmitted. Our review highlighted areas where encryption protocols could be strengthened.
We also provided recommendations for securing data stored in the cache to prevent unauthorized access, ensuring that sensitive information was cleared when no longer needed and protected from being exposed in browser sessions.
Enhancing logging and monitoring
One of the key defensive strategies in cybersecurity is logging and monitoring. By continuously monitoring system activity, potential threats can be detected early, allowing for rapid response. We reviewed the logging mechanisms in place for OpenLMIS and recommended enhancements to ensure that any suspicious activity, such as failed login attempts or unauthorized access attempts, was properly logged and monitored in real time.
This step is critical in maintaining the long-term security of the platform, as it allows the team to stay vigilant against emerging threats.
Technologies used
Looking forward: Continuous improvement and monitoring
Security is not a one-time event and not a single penetration testing session – it’s an ongoing process. OpenLMIS’s commitment to continuously improving its security posture is commendable, but like any software system, it needs to stay ahead of new threats. We recommended setting up a process for regular security audits, along with continuous monitoring for vulnerabilities.
This proactive approach ensures that as OpenLMIS evolves, so does its security – maintaining the highest standards of protection for the health systems and data it serves.
Conclusion
The security of OpenLMIS is crucial to its mission of supporting global health programs by enabling efficient supply chain management. Our comprehensive penetration testing uncovered opportunities for improvement, and our recommendations have helped the OpenLMIS team significantly bolster their system’s defenses.
