Pipeline for Automated Security and Technical Audits for Personal Health Train

This document is a technical report that discusses the Pipeline for Automated Security and Technical Audits for the Personal Health Train (PASTA-4-PHT), which is aligned with DevSecOps principles. The report outlines the necessity of innovative privacy-preserving approaches for processing sensitive data, particularly in healthcare settings. It details how the PASTA-4-PHT pipeline incorporates multiple phases to detect vulnerabilities in the Personal Health Train (PHT) before deployment. The evaluation of the pipeline includes both controlled tests, where vulnerabilities are deliberately introduced, and real-world audits of existing PHTs. The results indicate that the pipeline effectively identifies vulnerabilities, with findings showing up to 35 critical vulnerabilities per Train in real-world audits. Furthermore, the report emphasizes compliance with the General Data Protection Regulation (GDPR) and the importance of maintaining data integrity and security in sensitive environments. The document serves as a resource for researchers working with PHTs, offering a structured approach to assess and document potential vulnerabilities in data processing.