As healthcare continues to evolve, so does FHIR. Its ability to adapt to new technological advances, government regulations, and growing demand for patient-centric care has made it a vital part of the modern healthcare ecosystem.The popularization of the standard has led to robust FHIR-first solutions like the Kodjin FHIR Server designed to ensure seamless interoperability across diverse health systems. This article examines the current trends in FHIR development and provides insights into what healthcare providers, developers, and patients can expect in the coming years.

Table of Contents

1. The Evolution of FHIR: A Brief Overview
2. Key Drivers Behind FHIR Adoption
3. Current Trends in FHIR Development
   • FHIR and AI Integration
   • FHIR in Telehealth and Remote Patient Monitoring
   • FHIR’s Role in Value-Based Care Models
   • The Rise of Cloud-Based FHIR Solutions
   • Privacy and Security Enhancements
4. Future Predictions for FHIR
   • Expanding the SMART on FHIR Ecosystem
   • Enhanced Support for Genomic Data
   • Wearable Technology and FHIR Integration
   • FHIR in Global Interoperability Efforts
5. Conclusion: The Future of FHIR in Healthcare
6. FAQs

1. The Evolution of FHIR: A Brief Overview

FHIR has been under development since 2011 when HL7 recognized the need for a more flexible and web-based data exchange standard in healthcare. Prior standards like HL7 v2 and HL7 v3 faced challenges in terms of complexity and lack of adaptability to modern technologies. FHIR was created as a more modular and lightweight alternative, taking inspiration from modern web development standards such as RESTful APIs, which make it easier to integrate across different systems.

Unlike previous standards, FHIR organizes data into “resources,” which are modular components of healthcare information like patients, medications, observations, and diagnostics. These resources can be reused and extended, making the FHIR standard highly adaptable to diverse use cases. Today, FHIR has become the backbone of healthcare interoperability, used by hospitals, telehealth services, research institutions, and mobile health applications.

2. Key Drivers Behind FHIR Adoption

The rapid growth of FHIR adoption can be attributed to several major factors, including regulatory pressure, the demand for more patient-centered care, and the advancement of new technologies.

Regulatory Pressure

In countries like the United States, FHIR adoption has been accelerated by regulations such as the 21st Century Cures Act and mandates from the Office of the National Coordinator for Health Information Technology (ONC). These regulations aim to make health data more accessible to patients and mandate the use of FHIR-based APIs for data sharing.

Demand for Patient-Centered Care

Patients now expect more control over their healthcare data. The rise of patient portals, mobile health apps, and wearable technologies has made it essential for health data to be easily accessible, secure, and portable. FHIR plays a key role in meeting these expectations by enabling seamless integration between patient apps and healthcare systems.

Technological Advancements

The adoption of emerging technologies such as Artificial Intelligence (AI), machine learning, and big data analyticsis driving demand for standardized, interoperable data that FHIR facilitates. These technologies require structured, real-time data access, which FHIR enables by breaking down silos and enabling seamless communication between systems.

3. Current Trends in FHIR Development

FHIR continues to evolve and expand, both in terms of its technical capabilities and its impact on the healthcare ecosystem. Here are some of the most prominent trends shaping the future of FHIR.

FHIR and AI Integration

The integration of AI and FHIR is one of the most promising developments in healthcare. AI-driven tools such as clinical decision support systems, diagnostic algorithms, and predictive analytics require vast amounts of healthcare data to function effectively. FHIR’s standardized data model allows AI algorithms to access and analyze patient information from multiple sources in a consistent format.

Key Benefits of AI and FHIR Integration:

• AI algorithms can analyze FHIR resources to detect patterns in patient data and provide early diagnoses.
• By accessing FHIR data, AI systems can predict patient outcomes, suggesting preventive measures before conditions worsen.
• Integration enables clinical decision support systems (CDSS) to pull real-time data from FHIR-based EHRs, offering timely insights to healthcare providers.

Use Case:

For example, an AI system that analyzes patient data from FHIR-based EHRs could predict the likelihood of readmission for heart failure patients based on their previous health records, helping clinicians provide preventive care.

FHIR in Telehealth and Remote Patient Monitoring

As telehealth becomes increasingly popular, the role of FHIR in supporting remote patient monitoring (RPM) and virtual care is expanding. Remote monitoring devices such as smartwatches and wearable sensors generate valuable health data that can be transmitted via FHIR APIs to clinicians in real-time.

Key Trends:

• Integration of RPM with FHIR: Devices can monitor patients with chronic conditions (such as diabetes or hypertension) and send continuous data streams to FHIR-enabled platforms, allowing healthcare providers to respond to abnormal readings.
• Telehealth platforms are using FHIR to reduce the friction between patient intake and virtual consultations, automating the exchange of health data between systems.

Use Case:

Wearables that monitor glucose levels for diabetic patients can transmit data in real-time via FHIR-based APIs, alerting providers when levels deviate from a healthy range.

FHIR’s Role in Value-Based Care Models

The healthcare industry is moving towards value-based care (VBC), which prioritizes the quality of care over the quantity of services provided. In this model, providers are incentivized to focus on improving patient outcomes and reducing costs. FHIR is central to enabling this shift by facilitating the sharing of data needed to track outcomes, manage care coordination, and assess population health.

Key Trends:

• FHIR enables outcome-based reporting, allowing providers to measure performance in real-time and adjust care plans accordingly.
• Providers can use FHIR to aggregate data on social determinants of health, which are crucial for providing comprehensive, patient-centered care.

Use Case:

A healthcare provider could use FHIR to share data with a payer to demonstrate that a value-based care intervention, such as a diabetes prevention program, has successfully reduced hospitalizations for patients with prediabetes.

The Rise of Cloud-Based FHIR Solutions

Many healthcare organizations are moving their data and applications to the cloud, and cloud-based FHIR solutionsare becoming increasingly popular. Cloud platforms like Google Cloud Healthcare API and Microsoft Azure API for FHIR offer scalable solutions for healthcare providers looking to implement FHIR quickly and efficiently.

Key Trends:

• Cloud FHIR services are highly scalable and can manage vast amounts of health data with ease.
• These platforms come with built-in compliance for healthcare regulations such as HIPAA and GDPR, easing the burden of managing security and privacy.

Use Case:

A hospital may choose a cloud-based FHIR platform to consolidate data from multiple outpatient clinics, enabling easier management of patient data across locations while reducing IT infrastructure costs.

Privacy and Security Enhancements

With more patient data being exchanged between systems, ensuring security and privacy has become a top priority for healthcare organizations. FHIR incorporates security protocols such as OAuth2 and OpenID Connect, enabling secure access and authorization for healthcare applications.

Key Trends:

• OAuth2 and SMART on FHIR authentication layers ensure that only authorized individuals can access sensitive patient data.
• FHIR developers are continuously enhancing encryption methods to protect patient data during transmission.

Use Case:

FHIR-enabled healthcare applications use OAuth2 for secure authentication, ensuring that data access is restricted to authorized users like clinicians and patients.

4. Future Predictions for FHIR

As FHIR continues to gain traction, several developments will likely shape the future of FHIR in healthcare, enabling more advanced applications and broader adoption across the industry.

Expanding the SMART on FHIR Ecosystem

SMART on FHIR extends the FHIR framework to enable developers to build healthcare apps that can easily integrate with any FHIR-enabled system. As FHIR continues to evolve, the SMART ecosystem will likely expand, allowing for more sophisticated, third-party healthcare applications.

Expected Advancements:

• New apps built on SMART on FHIR will give patients greater control over their health data, allowing them to manage their health more effectively.
• More clinical apps will be developed to interact seamlessly with FHIR-based systems, driving innovation in healthcare delivery.

Example:

SMART on FHIR-enabled apps that allow patients to aggregate their medical records from multiple healthcare providers into a single application, offering a unified view of their health history.

Enhanced Support for Genomic Data

With the rise of precision medicine and genomics, FHIR will need to evolve to better handle genetic data. In the future, we can expect FHIR to support more advanced resources specifically designed for the exchange of genomics data, enabling clinicians to personalize treatment based on genetic profiles.

Expected Advancements:

• New FHIR resources will facilitate the exchange of genetic information, enabling healthcare providers to integrate genetic data with clinical decision-making.
• FHIR will be crucial for merging genomic data with traditional health records, making it easier to provide personalized care.

Example:

FHIR-based systems that integrate genomics data to help oncologists select cancer treatments based on a patient’s genetic markers.

Wearable Technology and FHIR Integration

Wearable technologies such as smartwatches, fitness trackers, and medical-grade devices are expected to become increasingly important sources of health data. Integrating this data through FHIR will allow healthcare providers to make data-driven decisions based on real-time patient information.

Expected Advancements:

• FHIR will become the standard for integrating wearable data into EHRs, enabling doctors to access data collected by wearables directly in their systems.
• The integration of wearable data will facilitate proactive healthcare, allowing providers to monitor patients’ health trends and take action when necessary.

Example:

A cardiologist could use FHIR to review heart rate data from a patient’s smartwatch, helping to identify irregular heart rhythms and prevent potential health issues.

FHIR in Global Interoperability Efforts

FHIR’s simplicity and adaptability make it well-suited for global interoperability initiatives. Organizations worldwide are starting to adopt FHIR to facilitate international health data exchange, improving care for patients who travel or seek treatment abroad.

Expected Advancements:

• FHIR will facilitate cross-border healthcare data exchange, allowing healthcare providers to access foreign patients’ medical records in emergencies.
• Governments and international health organizations will invest in FHIR-based platforms to enhance data exchange across borders.

Example:

In an emergency, a traveler from Europe visiting the U.S. could grant healthcare providers access to their medical records through a FHIR-based interoperability platform.

5. Conclusion: The Future of FHIR in Healthcare

FHIR’s adaptability and wide-ranging applications have made it an essential part of the healthcare technology landscape. As healthcare providers seek ways to improve patient outcomes, FHIR will continue to play a central role in advancing interoperability, enabling telehealth, and supporting new technologies like AI and genomics. Moving forward, FHIR’s role in healthcare will only expand, driving global interoperability and reshaping healthcare for the better.

FAQs

1. What does FHIR stand for in healthcare?

FHIR stands for Fast Healthcare Interoperability Resources, a data standard developed by HL7 for sharing electronic healthcare data.

2. How does FHIR support telehealth?

FHIR facilitates the exchange of patient data in real-time between telehealth providers and traditional healthcare systems, allowing for comprehensive patient care.

3. What is SMART on FHIR?

SMART on FHIR is a framework that enables developers to build apps that integrate with FHIR-based systems, making it easier to develop healthcare applications.

4. Is FHIR secure for exchanging patient data?

Yes, FHIR incorporates modern security protocols like OAuth2 and OpenID Connect to protect patient data during transmission.

5. How does FHIR enable value-based care?

FHIR facilitates the sharing of data needed to track and measure healthcare outcomes, which is essential for implementing and assessing value-based care models.

References

1. Health Level Seven International (HL7). “Fast Healthcare Interoperability Resources (FHIR).” Available at: https://www.hl7.org/fhir/
2. U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology (ONC). “Cures Act Final Rule.” Available at: https://www.healthit.gov/curesrule/
3. SMART Health IT. “SMART on FHIR.” Available at: https://smarthealthit.org/
4. Microsoft Azure. “Azure API for FHIR: A Fully Managed Health Data Solution.” Available at: https://azure.microsoft.com/en-us/services/healthcare-apis/
5. Google Cloud Healthcare API. “Supporting HL7 FHIR for Improved Healthcare Data Interoperability.” Available at: https://cloud.google.com/healthcare
6. McKinsey & Company. “The Future of Telehealth and Remote Patient Monitoring.” Available at: https://www.mckinsey.com/industries/healthcare/
7. American Medical Association (AMA). “Genomics in Medicine and the Role of FHIR.” Available at: https://www.ama-assn.org/
8. HIMSS. “Value-Based Care and the Role of FHIR Standards.” Available at: https://www.himss.org/
9. World Health Organization (WHO). “Interoperability in Global Health Systems: Current Standards and the Role of FHIR.” Available at: https://www.who.int/

The post Current Trends in FHIR Development: What to Expect in the Coming Years appeared first on Co-Desion.

What Is a Livestream Shopping Application?

Livestream shopping results from the convergence of video streaming, influence marketing, and e-commerce. Livestream retail describes a method of doing business in which retailers, influencers, and brands advertise and sell things using the medium of live streams. These sessions may well be held via a social media channel, a smartphone website, a platform, or marketplace.

The Evolution of Livestream Shopping

Live shopping, often known as live commerce, is a revolution in e-commerce that started in China and has now expanded to other countries. This experience of online shopping in a market-like style may be traced back to Taobao Live, which debuted in 2016 on the app developed by Alibaba. Livestreaming and shopping were brought together for the first time in China thanks to a project that Alibaba Group spearheaded. The channel was designed to engage, entertain, and educate consumers about new trends.

The Global Ascent of Live Shopping

Over the last few years, the recognition of live-shopping platforms has increased to the point that it has expanded beyond the boundaries of certain regions and into every corner of the world. Amidst the rise of digital-first retail practices and intensifying rivalry among companies, livestream shopping has established a solid presence in the industry.
The exponential growth of the metaverse adds further weight to the compelling argument that live commerce has enormous untapped potential as a core sales channel. As an early indicator, Samsung released its most recent product, the Samsung Galaxy S22, in a completely virtual setting.

Advantages of Livestream Shopping for Brands and Retailers
The worldwide live commerce ecosystem has had a number of noteworthy events over the course of the last few years. Companies of various sizes, including industry heavyweights such as Google, Pinterest, Twitter, and TikTok, as well as start-up businesses, have all experimented with this novel method of selling products and services. But what specific advantages does shoppable video streaming provide for these businesses?

Conversion rate increase

Greater sales are driven due to the enhanced convenience of real-time shopping. As stated by McKinsey, firms claim conversion rates that are on average 30% higher during live shopping events. In 2021, conventional e-commerce in the United States only reached 2.8%.
Improving brand appeal and differentiation
Additionally, companies are getting into the livestreaming game to improve their brand image. The technology enables businesses and retailers to have real-time conversations with customers, giving the impression that the brands are more accessible to the target audience.

Authenticity

Livestream shopping delivers the brand right to the customer’s smartphone without requiring video editing or photoshopping. It implies that clients get an unedited picture of the actual goods and that when they make a purchase, it appears precisely the same as it did on live stream. Because of this, live events provide the impression that corporations are genuine and focused on people. This advantage is essential for contemporary organizations since 90% of customers consider authenticity the most important consideration when choosing a brand.

Engagement in real time

The audience participation and the unpredictability of the livestreaming both contribute to the excitement of live shopping. Because users may post comments and ask questions in real time during live shopping, viewers are more involved in the purchasing experience.

Entertainment

Livestream shopping combines the worlds of commerce and live video entertainment to provide an experience that is more pleasant and diverse than traditional shopping. More likely, this one-of-a-kind combination of genuine rapport, shopping, and an enjoyable experience will fulfill the requirements of 31% of customers in the United States who are ready to spend extra for an unparalleled shopping experience.
In-store activities such as quizzes, challenges, and unpacking sessions may contribute to the gamification of live shopping by appealing to customers’ natural desire to play.

Immersive experience

Live videos allow businesses to add multimodal interactions that can help them develop a good emotional relationship with a consumer. These interactions have a characteristic known as immersiveness, and they present themselves as a blend of extended reality and flat user interfaces. Immersive-first technologies like augmented reality (AR) and virtual reality (VR), for example, may create an even deeper level of immersion and display a product from any angle.

Top 5 Livestream Shopping Applications

Even though the host and the goods are quite important, the software is the channel that connects your business with the clients. In order to provide you with a more in-depth understanding of what live-shopping software entails, we have compiled a list of the top choices available to assist companies in selling their stock live.

TalkShopLive

This app for live streaming is marketed as a robust platform for live streaming and home shopping. TalkShopLive is a famous platform with top celebrities and brands. It enables anybody to sell live by establishing their own channel. Customers can be converted into buyers via integrations, in-platform purchasing, and automated fulfillment.

Bambuser

This livestreaming app was founded in Sweden, another network with significant promise for live shopping. Since 2007, Bambuser has addressed the requirements of retailers, global brands, and enterprises by simplifying the selling process and making it more personal and engaging.

Channelize

Channelize, a complete e-commerce solution for B2C companies, is yet another option on our list of livestream shoppable platforms. Channelize allows businesses to engage customers in real-time by enabling seamless integration, scalable APIs, SDKs, and user interface kits. These features all help to reinforce a company’s brand image.

Livescale

Livescale is a live commerce startup that allows companies to generate awareness and revenue using a personalized and branded experience for their customers. The product feed synchronizing, integrated adoption, easy checkout integration, and complex first-party analytics are some of the defining aspects of the features.

Amazon Live

Amazon, which has the dominant position in the retail industry, was one of the pioneers in starting this trend. Since 2016, Amazon Live has assisted companies in showcasing their items, promoting those products, and engaging with their target audience in real-time. Through the use of the Amazon Live Creator app, businesses have the opportunity to begin live-streaming on Amazon. This tool assists in the production of live streams, the same as their capture and management.

To Sum Up

People’s shopping habits are shifting due to the increasing prevalence of digital technologies in today’s environment. They are no longer in need of, or interested in, shopping at traditional stores. Rather, shopping online has become the norm in the society that has emerged after the pandemic.
In the last several years, it has been abundantly clear that emotion, contact, and dialogue are all quite important for companies. Without these elements, organizations can only compete with one another to see who can provide the lowest price, and Amazon is already in the lead in this competition. Therefore, the only way to achieve organic sales in the digital age is to provide a more humanized experience.
Livestream shopping, on the other hand, gives a more personal feel to the product or service by combining elements of digital, interactive, and social. Because of all these factors, live shopping is now very marketable, with improved conversions and enhanced brand awareness.

Orangesoft will assist you in embracing the live streaming future of retail and will simplify this process. Please get in contact with us, and we will collaborate on the development of a cutting-edge livestream shopping app.

The post Development of a Livestream Shopping App: A Tutorial appeared first on Co-Desion.

As the experience of telecommunications giant Nokia shows, this creates opportunities and challenges for enterprises to serve their customers. The Finnish company recently began using Microsoft Azure Arc, a platform for managing and multi-cloud environments, taking a key step in its quest to serve customers in the new environment.

The journey to Azure Arc began in 2016, when Nokia launched its Analytics, Virtualization and Automation (AVA) system, an artificial intelligence-based analytics platform. The company developed the system to help its customers — cellular carriers — use data to improve operational efficiency, increase revenue and provide a better user experience for their customers. Until then, Nokia engineers had been inputting data into spreadsheets and using manual data processing techniques for analytics. This approach was inefficient, error-prone and unsuitable for processing large amounts of data.

“Given the significant increase in performance and network size, that path was no longer acceptable,” says Paolo Tornaghi, who heads the technology and architecture group in Nokia’s advanced business applications services division. – We needed scalable applications for customers.”

The AVA system uses data from network operations and other sources to draw inferences from artificial intelligence and find solutions to workflow problems. In 2019, Nokia moved AVA to the cloud. The move to Azure gave Nokia the ability to offer AI-powered analytics through AVA to customers around the world without having to manage separate cloud services.

Using the cloud provided immediate benefits, but as Nokia began to scale AVA, new needs arose. For some customers, specific regulatory requirements suggested the need to store data internally, while other customers wanted to use AVA in other public or private clouds rather than the Nokia cloud.

Azure Arc allows users to manage distributed environments in on-premises, edge and multi-cloud environments.

Developing customized solutions for individual customers wasn’t feasible, and Nokia needed to find a way to deploy its AVA services in a unified way across any Kubernetes builds that customers were using.

“That became a problem for us. We couldn’t offer AVA to our customers who had those limitations. We had to do something about it,” says Kalyanjit Gogoi, head of research and development for Nokia’s advanced business application services. – That’s a problem we put to Microsoft and asked, “How do we deal with it?” It’s a very close partnership. We develop many of our solutions together.”

Microsoft’s engineering team worked closely with Nokia to integrate Azure Arc with AVA and develop the flexible, scalable infrastructure management solution customers need. Azure Arc, launched in 2019, enables resource design in Azure and centralizes the management of the company’s multi-cloud and on-premises technologies, from data centers to peripherals. For Nokia, the implementation of Azure Arc means that the company can manage and control AVA applications that run on customer-preferred cloud services while complying with data requirements in different countries. Sensitive data stays in the customer’s cloud and is not transferred anywhere.

The new Azure Arc-enabled AVA architecture consists of two parts: the Nokia-owned Azure subscription cloud, where AVA applications and tasks are concentrated, and the Kubernetes stack-enabled client cloud, on which Nokia deploys and supports its AVA applications. The two clouds communicate over a secure channel.

The post How Nokia uses Azure Arc to empower customers in a multi-cloud world appeared first on Co-Desion.

Building services above the base tier is more difficult. You need to be sure that all services, not just yours, are up and running. An example is a PaaS that runs on a Kubernetes infrastructure, namely the master node group, on which the management plane functions: kube-apiserver, scheduler, controller-manager and database. They manage the Kubernetes cluster and distribute the load. There is also a group of worker nodes on which these workloads are executed.

When the Kubernetes container starts up, the latter “runs” on one of these nodes. Communication begins: the masters join together in a quorum, exchanging data. The wizard also communicates with the vorkers and tells them what to do, and what to do if any of the nodes break. Everything happens inside the network, and such a cluster has a load balancer that distributes traffic to the master nodes.

We can’t just deploy Kubernetes on top of the infrastructure via Terraform, this process is hard to control. Something can go wrong and we can’t react quickly. And we need to react, so we have a consistent process that looks like this:

This is a flowchart of creating a Kubernetes cluster in a cloud infrastructure. Some steps and branching are omitted, but the general logic is like this:

• Initialize, create and configure the network
• Create and configure the master node
• Configure the management plane
• Create and start the worker node
• Reconfigure and start up the remaining resources
• Test availability and release the cluster to the client

How did we test?

There’s such a thing as a test pyramid, it shows the ratio of tests in the project. At the bottom are Unit-Tests, which should be the majority, then come Integration Tests, then End-to-end, Functional and other tests. They are more expensive to write and run, but you need less of them because almost everything is covered by Unit-tests. That’s exactly the scheme we started with.

It turned out that most popular methods don’t suit our project because it is based on distributed sequential processes executed asynchronously.

What disadvantages did we find?

Let’s analyze each type of tests separately:

Unit tests: generally good, but there are nuances. First – they don’t allow us to cover a multi-step process. Second, because of the specifics of our processes Unit-tests are often inefficient: we don’t have any individual small functions, but we do have domain logic. We develop services as part of domain driven design, and the logic is combined around domains and aggregators. For each step we have to prepare the state of the domain, then perform the step and run tests. Unit tests don’t lend themselves well to DDD, because in our case DDD is very much about working with states. Can this be covered by integration tests?

Integration tests have pros, but there are obvious cons. They are expensive to run and not well suited for logic testing. An integration test is good to write when it is the interaction with the database that must be tested. There is a fixed number of SQL-queries, and we write a test for each of them. But a large number of logical operations leads to branching of scenarios. Conducting an integration test for each of them is long and expensive, hard to write and maintain.

End-to-end tests. They are good, but they are also long and difficult to write. Such tests are hard to maintain: every time the services change, you need to change the tests too. The frequency of change is roughly equal to the number of tests multiplied by the number of services. In addition, it is almost impossible to raise the entire environment at once. If your service is running a virtualization infrastructure – you can’t just emulate that infrastructure, you have to run virtual machines and networks, which is expensive and not always possible.

And what about API tests, you ask? There’s an ambiguity here: our API is quite thin, there are some rest entities that the frontend works with, and behind them there’s a layer of technical, infrastructure and business logic that changes faster than the API. In addition, not everything works through the API – there are some processes inside the service: autoscaling, autohealing, working with persistent volume.

The post Which tests to choose for the cloud? Comparing options appeared first on Co-Desion.

I have divided the scanner’s work into the following steps:

• Checking open ports, detecting running services and OS.
• Vulnerability detection.
• Security assessment.
• Writing a report.
• Exploitation of a vulnerability (requires permission from the administrator of the system being scanned, as it may result in a security breach).

Scanning types

Vulnerability scanning is one of the initial stages of the penetration testing (pentest) task. Vulnerability scanning, like pentest or any testing, can be divided into several types. Let’s look at each through the lens of a vulnerability scanner:

WhiteBox. The scanner is executed inside the analyzed network, which enables a more complete and complex study of vulnerabilities, there is no need to “guess” the type of service or operating system. The advantage of this method is in its full and complex approach to investigation, but its disadvantage is that it is less close to a real attack of an intruder.

BlackBox. “BlackBox. The scanner is run from outside the network under investigation, which makes it necessary to work through publicly accessible interfaces. The application needs to analyze the open ports, “guess” the services, and detect vulnerabilities based on the information obtained. This variant is as close to the real situation as possible: the scanner has only the IP or domain name to check as the initial data. On the downside, you might mention that the applications used in the DMZ will remain undetected.

Of course, you can argue for a long time about the pros and cons of different types of scanning, but hardly anyone will argue against the necessity of testing. And practice shows that the combination of both methods yields the best results. It seems to me that it makes more sense to first do the BlackBox scan and then the WhiteBox scan. By the way, we are now working on creating a service for clients, which will allow us to check the infrastructure located in the Cloud4Y data center using BlackBox scanning. The service will save from unpleasant accidents when due to human error ports were not closed or other potentially dangerous “holes” were left.

Selecting the product – the basis for service

In order to select a product intelligently, you need to set criteria that it must meet:

Mandatory:

• Free or limited to a paid version that fits the parameters.
• High-quality search of open ports.
• Works with IP addresses.
• Looks for vulnerabilities – CVE base references, CVSS metrics threat level or similar.
• Flexible customization.
• Report output.

Optional:

• Availability of technical documentation, technical forums.
• GUI.
• Output of the report in a convenient format.
• Sending results to email.
• API.

Not every product on the market complies with such a set of criteria, especially in the segment of free software, but the task is there and we will find a solution. Let’s analyze what is fashionable nowadays in IS circles as free solutions. After searching and analyzing the solutions we have chosen several products to investigate:

• OpenVas.
• Tenable Nessus.
• Gobysec / Goby.
• Tsunami-security-scanner.
• Flan Scan.
• D9scan.
• Rustscan.
• Owasp ZAP.
• W9Scan.
• Nmap.

The post Vulnerability scanning appeared first on Co-Desion.