Endpoint, Application, and Software Security
Endpoint and application questions test secure build, patching, and assurance across the software lifecycle. In eHealth, a vulnerable patient portal or unmanaged clinician laptop can expose thousands of records.
Endpoint controls
Harden baselines, remove unnecessary services, enforce disk encryption, and deploy EDR with behavioural detection. Patch operating systems and third-party software on a risk-based cadence; track exceptions. Use application allow-listing where feasible. Mobile and BYOD need MDM or MAM, separation of work data, and remote wipe. Asset inventory must include clinical workstations and connected devices.
Application security
Adopt a secure SDLC: threat modelling, secure coding standards, SAST, DAST, SCA, and penetration testing before major releases. Maintain an SBOM for third-party components. Prioritise vulnerabilities using exploitability and data sensitivity, not CVSS alone. Validate authorization on every request; APIs are a common source of broken object-level authorization. Protect secrets in a vault, not source code. For cloud-native apps, scan images and pin dependencies.
Worked example
A patient portal adds an API to download a record. STRIDE threat modelling flags information disclosure and elevation of privilege. SCA finds an outdated JSON library; DAST finds an IDOR where changing the patient ID returns another patient's record. The team adds server-side authorization checks tied to the authenticated patient, upgrades the library, and adds regression tests for object-level access. Reasoning: the design flaw, not the CVE score, was the real risk.
Traps
Prioritising only by CVSS. Ignoring APIs and authorization flaws. No SBOM or dependency inventory. Treating a penetration test as a one-time compliance checkbox. BYOD without containerisation. Hard-coded credentials.