Measuring the State of Information Security and Data Protection in Healthcare Web Applications

The digitalization of healthcare requires robust information security and data protection measures. This work outlines a methodology for assessing these aspects using the Technical Guideline TR-03161-2 from the German Federal Office for Information Security (BSI). The approach involves comparing the current information security and data protection state of a healthcare web application against predefined requirements and identifying threats based on unmet criteria. Identified security deficits are quantified in economic cost terms through use of the Annualized Loss Expectancy (ALE) framework, providing a realistic assessment of the economic impact of information security and data protection risks.