Analýza a testování kybernetické bezpečnosti ordinace praktického lékaře

This bachelor thesis focuses on the analysis and testing of cybersecurity in an anonymized general practitioner’s office. The aim of the thesis is to assess selected areas of the office’s security and, based on the identified weaknesses, propose appropriate security measures. The theoretical part defines the specifics of cybersecurity in the healthcare environment, describes the sensitivity of medical data, the typical infrastructure of a small medical office, and the most common cyber threats. It also introduces selected methods of security analysis, basic principles of penetration testing, and relevant legal and methodological frameworks. The practical part is carried out as non-destructive grey-box testing. It focuses mainly on the local network, available network services, network devices, wireless infrastructure, authentication, the basic state of backups, and a simulated phishing test. The results showed that the most significant risks arise primarily from a combination of weak configuration of the main network device, unnecessarily exposed services, insufficient network segmentation, and operational weaknesses in access management. Based on these findings, the thesis proposes prioritized security measures, including changing default credentials, disabling unnecessary services, securing workstations, segmenting the network, and verifying backup recoverability.