Case Study · IT Audit - Engave S.A.
How a comprehensive IT audit at a medical facility uncovered critical security gaps - and how some of them were addressed while the audit was still underway
Project at a glance
Client
Public-sector healthcare facility - several locations, a server environment supporting medical systems, patient data, and administration
Scope
Comprehensive audit of 8 areas: server room, LAN/WAN network, procedures, server environment, workstations, licenses, peripheral devices, GPO policies
Team
Paweł Kacprzak (IT Manager), Piotr Seferyński (Senior System Engineer)
In progress
Installation of the Veeam backup agent on three servers and setup of automatic cloud backups - while the audit was still underway, without waiting for the final report
Result
Full documentation of the current state, a prioritized action list, and a ready-made plan for strengthening security and business continuity
Problem
Healthcare is one of the most frequently targeted sectors for ransomware attacks in Europe. The reason is simple: medical data is exceptionally valuable to criminals, while medical facilities - especially public-sector ones - rarely have dedicated IT security teams. Infrastructure grows alongside clinical needs, software is selected with medical use in mind, and issues such as network device vendor support or GPO policies take a back seat.
The facility decided to carry out an IT audit on its own initiative - to get an objective picture of its environment and a clear list of priorities. That decision takes courage: an audit always uncovers more than expected. But it uncovers it before anyone else does.
Areas identified for improvement
The key edge device protecting the facility's network had been running with an expired vendor service contract - for 579 days at the time of the audit. This meant no security updates, no support in the event of a failure, and no way to quickly replace the device if it broke down. In the event of an incident: facility downtime and no possibility of an operational response from the vendor.
Employee workstations, medical servers, and other devices all ran on a single, flat network. With no separate zones, any compromised endpoint had potential access to server resources - no barrier in between. Recommendation: three separate VLANs for network devices, employees, and guests.
The domain controller was running Windows Server 2012 R2, which has not received security updates since October 2023. The database server was running SQL Server 2014 - also out of its support cycle. Known vulnerabilities in these systems are publicly documented and actively exploited by attackers.
Outdated software versions representing known attack vectors were identified on the servers: Java 8, an alpha version of 7-zip, .NET Core modules past their current support cycle, and a medical system not updated to the latest version. Unused packages installed on production servers increase the attack surface with no operational benefit.
At the start of the audit, the facility had no working, automated backup system. With no local NAS repository, there was no way to quickly recover from a failure or ransomware attack. Engave installed a Veeam agent and set up daily backups to the cloud during the audit itself - without waiting for the final report.
The audit found no account lockout policy configured after failed login attempts, Windows Defender Antivirus disabled at the GPO level, no security auditing (event logging), and no enforced Windows Update. Each of these gaps is a separate attack vector.
The facility had no network diagram, no configuration documentation, and no written procedures for backup and recovery, incident response, granting and revoking access, or system updates. The lack of an access revocation procedure is especially significant in environments with staff turnover - access to medical data can remain active after someone leaves the organization.
One network switch only supported 100 Mb/s instead of Gigabit speeds - creating a bottleneck for workstations in its section of the network. Recommendation: replace with a manageable Gigabit switch.
Medical data is classified as a special category of data under GDPR. A breach involving this data brings a notification obligation to the Polish Data Protection Authority (UODO), potential fines, and - more importantly - real harm to patients. An IT audit at a medical facility isn't a compliance formality. It's verification that the gateway to this data is actually locked.
What was addressed
579 days
the time elapsed since support expired for a key edge device - identified and replacement scheduled
Immediately
backup launched during the audit - Veeam + cloud, without waiting for the final report
8 areas
full documentation of the current state with a prioritized list of actions and recommendations
The audit gave the facility something it never had before: a complete, documented picture of its infrastructure - showing what's critical, what's urgent, and what can wait. Facility management gained a fact-based foundation for IT investment decisions, rather than relying on guesswork.
One action was taken immediately - without waiting for formal sign-off on the report. No backup in an environment processing medical data is a risk that can't wait for a schedule. Veeam with automatic daily backups to the cloud means that in the event of a building disaster or ransomware attack, the facility has a recovery point. That's a shift from 'zero' to 'protected' - within a single working day.
In parallel, a hardening plan was prepared for all remaining areas: migrating server operating systems, segmenting the network into VLANs, updating software, implementing GPO policies, and building documentation and procedures. Prioritization takes into account both the level of risk and the facility's operational requirements - changes cannot disrupt clinical work.
Why it matters
Medical facilities in Poland have experienced several high-profile ransomware incidents in recent years. Each followed the same pattern: IT infrastructure developed over years without regular reviews, known vulnerabilities left unaddressed, backups that existed only on paper. The results: weeks of downtime, patient care reverting to paper-based processes, data breaches, and UODO proceedings.
This audit shows that diagnosis is possible before an incident happens. A firewall unsupported for 579 days, servers running an operating system with no security updates, no backup - each of these findings represents a potential attack that never happened. Because someone asked the question in time.
For Engave, this project confirms a principle we apply to every audit: a report isn't a list of problems - it's a list of decisions an organization can now make calmly, instead of in crisis mode.
What this means for your facility or organization
An IT audit at a medical facility or any organization handling sensitive data is an investment that pays off the moment something goes wrong - and you don't have to start from scratch. It starts with a single conversation.
engave.pl/kontakt
Engave S.A. · engave.pl · All rights reserved
Cybersecurity, IT care, digitalisation - whatever the topic, we're happy to talk. Describe your need and the right specialist will get back to you within 24 business hours.
CONTACT:
biuro@engave.pl
+22 863 13 90
Technical support: +48 604 470 151
16 Czarodzieja St., 03-116 Warsaw, Poland