# Security remediation for a laboratory group.

> For the Italian branch of an international group of testing laboratories, we closed external rating and penetration test findings and simplified the infrastructure that generated them.

- Sector: Healthcare
- Practice: Security
- Year: 2026
- URL: https://cloudfactory.it/en/work/security-remediation-laboratory-group/

## In brief

An international group measures the security of its branches with an external rating and periodic penetration tests. For the Italian branch we fixed TLS configuration and certificates according to group policy, updated servers and CMS, added security headers, migrated the email gateway to Microsoft 365 and rationalised the domains. Then we planned the replacement of three inherited servers with two new ones, managed directly.

- **3** inherited servers to retire
- **2** new servers, one Linux and one Windows
- **1** certificate authority, as group policy requires

## Context

The Italian branch had sites, services and domains grown over the years on different hosts and servers, run by several vendors. The group enforces common policies: certificates from a specific authority, periodic scans, an external rating to keep above threshold.

## The problem

Findings came from different sources and touched different systems: a site with non-compliant TLS, Windows servers missing patches and up-to-date protection, DNS run on the group's internal servers, a broken copy of a service on the new server. Closing a finding without removing its cause meant seeing it again at the next scan.

## What we did

1. **One list, one owner per item.** Each finding mapped to its system, to who can act on it and to the closure check. DNS run by the group goes through their engineers; we handle the rest.
2. **TLS and certificates.** Corrected TLS configuration and certificates issued by the authority required by group policy, not the free one.
3. **Servers, CMS and headers.** Patches and endpoint protection on Windows servers, .NET and CMS upgrades, security headers on web responses. The penetration test work closed with the report delivered.
4. **Email and domains.** Email gateway migrated to Microsoft 365 in coordination with the group. Domains rationalised with redirects to the main site.
5. **Remove the cause.** A consolidation plan: retire three inherited servers and create two new ones, one Linux and one Windows, managed directly, and move everything there.

## How it went

The penetration test work is closed with the report delivered. For the external rating, with the technical findings fixed, the group is asked for formal closure. Server consolidation cuts the number of things to watch and vendors involved.

## Tools

Windows Server 2022, IIS, Ubuntu, Umbraco 17, .NET, Microsoft 365, Sectigo, BitSight, DAST

## FAQ

### Why not use free certificates?

They work well, but some groups require certificates from a specific authority by policy. The client's policy counts, not our preference.

### What is an external security rating?

A score computed from outside by looking at domains, certificates, configuration and public signals. Large companies and insurers use it to assess the risk of a branch or a supplier.

---

Cloudfactory S.r.l., Rome. Contact: hello@cloudfactory.it