Multi-Factor Authentication (2FA/MFA) for CGM CLININET

Secure access to CGM CLININET HIS and the web-based components of CGM CLININET ERP with multi-factor authentication from Rublon MFA. Rublon App Shield enables you to add MFA before users access a self-hosted web application without modifying its source code.

When signing in to the application, users can verify their identity using phishing-resistant authentication methods, including FIDO security keys and FIDO2 passkeys, such as a Windows Hello passkey, a passkey stored in a password manager, or a passkey on a mobile phone. Rublon App Shield supports FIDO2 methods and passkeys for web applications protected by its access layer.

What Is CGM CLININET?

CGM CLININET is an IT environment designed for hospitals and other healthcare organizations. It includes CGM CLININET HIS, which supports clinical processes, and the associated CGM CLININET ERP system, which supports financial and administrative processes.

CGM CLININET HIS supports patient registration, medical records, hospital ward workflows, diagnostics, medication management, orders, settlements with the Polish National Health Fund (NFZ), reporting, and integration with other systems used by the healthcare organization. The vendor states that the system can be used in a standard web browser environment.

CGM CLININET ERP is a suite of financial modules designed for healthcare organizations. It covers finance, accounting, human resources, payroll, materials management, cost calculation, electronic document workflows, and management reporting. The ERP system is integrated with the clinical part of the environment, enabling information to be exchanged between clinical and administrative areas.

When the installation is hosted locally in the healthcare organization’s infrastructure, browser-based access to CGM CLININET can be protected with an additional security layer provided by Rublon App Shield.

Can You Enable MFA and 2FA for CGM CLININET?

You can protect access to a self-hosted CGM CLININET HIS system that runs in a web browser with Rublon App Shield. The solution acts as a security layer in front of the web application and requires additional identity verification before the user can access the system.

This approach enables you to deploy Rublon MFA independently of the application’s source code. It does not require adding any Rublon MFA software library to the application or installing an agent inside it.

You can use the same approach to protect CGM CLININET ERP components that are provided to users as self-hosted web applications. However, the scope of protection for the ERP part must first be confirmed based on the architecture of the specific installation and how individual modules are made available.

Rublon App Shield is designed for self-hosted web applications running on-premises or in customer-controlled cloud infrastructure. The exact configuration is adapted to how the application is published and to its sign-in and sign-out flows.

Learn more about Rublon App Shield.

How Does Rublon App Shield Protect Access to CGM CLININET with MFA?

Rublon App Shield controls access to the web application before the user establishes an application session. Rublon App Shield is placed in front of the protected application and grants access only after the required authentication steps have been completed.

An example sign-in process works as follows:

1. The user opens the protected CGM CLININET address in a web browser.
2. Traffic to the application passes through the Rublon App Shield security layer.
3. The user is prompted to complete additional authentication with Rublon MFA.
4. The user verifies their identity using the selected authentication method.
5. After successful verification, the user is granted access to CGM CLININET.

MFA is enforced outside the application itself. This means the organization’s authentication strategy does not have to depend exclusively on the security features provided separately by each specialized system.

MFA Without Changes to the CGM CLININET Source Code

A traditional MFA integration with a web application usually requires source code modifications, an additional plugin, an API integration, or assistance from the application vendor.

Rublon App Shield uses a different approach. A dedicated security layer is placed in front of the protected application, and users must complete multi-factor authentication before they are granted access.

This enables the organization to:

• deploy MFA without modifying the source code of the CGM CLININET web interface,
• avoid installing an agent inside the protected application,
• retain the existing system sign-in mechanism,
• centrally manage authentication methods and access policies,
• apply the same protection model to other web applications used by the healthcare organization.

Rublon App Shield does not require a plugin, a connector, or any parameters configured inside the protected application.

Deployment only requires configuring Rublon App Shield and directing user traffic to the application through the protected access path. The exact configuration depends on the architecture of the specific CGM CLININET environment.

Scope of Protection for CGM CLININET HIS and CGM CLININET ERP

CGM CLININET HIS and CGM CLININET ERP perform different functions and may consist of multiple modules made available to users in different ways.

CGM CLININET HIS is available in a standard web browser environment. Therefore, the browser-based HIS interface is the primary area to consider protecting with Rublon App Shield.

For CGM CLININET ERP, you must first determine which modules are available through a web browser and whether traffic to them can be directed through the App Shield layer. Rublon App Shield can protect self-hosted web components, but it does not automatically cover modules that use a desktop application or another type of client.

Access to non-web components can be secured at another level, for example by protecting:

• sign-in to a Windows workstation,
• RDP connections or Remote Desktop Services,
• VPN access,
• a server or administrative environment,
• an application published through remote access infrastructure.

This approach enables Rublon MFA to protect both the browser-based elements of the CGM CLININET environment and the technologies used to access its other components.

Signing In to CGM CLININET with Phishing-Resistant FIDO2 Security Keys and FIDO2 Passkeys

Rublon MFA enables organizations to use phishing-resistant authentication methods. Access to CGM CLININET protected by Rublon App Shield can be verified using:

• a hardware FIDO2 security key,
• a Windows Hello passkey,
• a passkey stored in a supported password manager,
• a passkey stored on a mobile phone or another mobile device.

A FIDO2 security key requires physical possession of the device and, depending on its configuration, entering a PIN or completing biometric verification.

FIDO2 passkeys enable authentication using capabilities available on a computer or mobile device. They can use facial recognition, a fingerprint, or the device PIN.

Unlike traditional authentication methods such as TOTP one-time passcodes, FIDO2 mechanisms are bound to the legitimate service. This makes the sign-in process more resistant to phishing and fraudulent websites designed to capture user credentials.

One MFA Solution for HIS, ERP, and the Rest of the Infrastructure

A key benefit of Rublon MFA is the ability to use one solution to protect not only CGM CLININET HIS and the web-based components of CGM CLININET ERP, but also other applications, servers, workstations, remote access services, and network devices used by the healthcare organization.

Protecting access to a Hospital Information System is only one part of securing a healthcare environment. Personnel may also use workstations, Remote Desktop Services, VPNs, servers, administrative systems, diagnostic tools, and other on-premises and cloud applications.

Instead of deploying a separate two-factor authentication (2FA) solution for every technology, the organization can use Rublon MFA to centrally secure multiple access points.

Depending on the integrations used, Rublon MFA can protect:

• Windows sign-ins,
• RDP connections and Remote Desktop Services,
• VPN access,
• Linux servers,
• applications using RADIUS, LDAP, SAML and OpenID Connect,
• self-hosted web applications,
• administrative tools and internal systems.

Administrators can manage users, authentication methods, access policies, and event logs as part of a single centralized solution. This helps maintain consistent MFA policies across the organization instead of operating separate authentication mechanisms for every system.

Learn more about Rublon MFA for healthcare.

Why Should You Protect HIS and ERP Systems with MFA?

CGM CLININET HIS gives personnel access to information used in patient care and clinical processes. If a user account is compromised, an unauthorized person may gain access to medical records, test results, orders, or administrative functions of the system.

CGM CLININET ERP may contain financial, human resources, payroll, inventory, and management information related to the operation of the healthcare organization. User accounts in the ERP part may allow operations that affect finances, documents, human resources, and administrative processes.

A password alone does not provide sufficient protection if it is phished, guessed, reused in another system, or captured by malicious software.

Multi-factor authentication (MFA) requires an additional identity verification step. Even if an attacker obtains the user’s password, they must still complete the second authentication step.

Deploying Rublon MFA can help a healthcare organization:

• reduce the risk of unauthorized access to HIS and ERP systems,
• protect the accounts of medical, administrative, and management personnel,
• mitigate the impact of password theft and phishing,
• use phishing-resistant authentication methods,
• standardize protection across healthcare systems and other infrastructure components,
• record authentication events for monitoring and auditing,
• support organizational and regulatory access control requirements.

Additional Protection for Sensitive Actions

Rublon App Shield can extend protection beyond the initial sign-in screen. After analyzing the interface and workflows of a specific application, the organization can consider implementing additional security rules.

Depending on the technical capabilities of the environment, these rules can:

• require additional authentication before a high-risk action is performed,
• block access to selected pages or application elements,
• prevent unauthorized users from performing specific operations.

Rublon App Shield enables step-up MFA and can block selected pages, elements, and actions in the protected web application. Applying such rules to specific areas of CGM CLININET requires prior verification of the application’s behavior and the preparation of appropriate selectors or protection rules.

How to Start the Deployment

To verify whether a specific CGM CLININET environment can be protected with Rublon App Shield, contact Rublon Support.

The following information is useful during the initial assessment:

• the CGM CLININET version,
• the CGM CLININET HIS and CGM CLININET ERP modules in use,
• how the system is hosted and published,
• a list of components available through a web browser,
• the addresses users open to access the applications,
• the sign-in and sign-out flows,
• how users are identified,
• the directory service used by the organization,
• the required authentication methods,
• high-availability requirements,
• whether a pilot test can be performed.

You must also determine which CGM CLININET components are available through a web browser and which require a desktop application, an RDP connection, or another access method.

After the environment has been verified, the appropriate configuration and a detailed deployment guide can be prepared.

Frequently Asked Questions

Related Posts

Secure Hospital Information Systems (HIS) with Rublon MFA

Secure ERP Systems with Rublon MFA

Multi-Factor Authentication (MFA) for Healthcare

Agentless MFA for Self-Hosted Web Applications Without Code Changes With Rublon App Shield

Multi-Factor Authentication (2FA/MFA) for Optimed NXT

Multi-Factor Authentication (2FA/MFA) for AMMS