DigiD Pentest

DigiD is important for organizations that handle citizens' personal data. These include, for example:

• Government bodies such as municipalities, ministries and the tax authority.
• Healthcare institutions such as hospitals and health insurers.
• Educational institutions such as universities and colleges.
• Pension funds that manage pension schemes.

These organizations must use DigiD because they need the Citizen Service Number (BSN) to identify people.

DigiD sets strict requirements for the security of systems that work with it. Think for example of making two-factor authentication (2FA) mandatory, such as logging in with an SMS code or the DigiD app. Data must also always be transmitted and stored encrypted, so that, for example, Citizen Service Numbers (BSN) do not leak.

In addition, web applications that use DigiD must be protected against common cyber threats, such as SQL injections and XSS attacks. An incorrectly configured website can allow hackers to gain access to sensitive data or even take over users' sessions.

Because these systems are an attractive target for cybercriminals, organizations must have an ICT security assessment carried out annually by an independent auditor. This is comparable to a vehicle inspection: if an organization does not meet the requirements, Logius can block access to DigiD. We carry out the mandatory pentest as part of this process, identifying vulnerabilities in systems before malicious actors do. This allows organizations to take timely action to keep their DigiD connection secure.

According to the “Handreiking ICT-beveiligingsassessment DigiD 2024” guidance from NOREA, organizations that use DigiD must carry out a penetration test on their DigiD web application and the associated infrastructure at least once a year. In addition, running a pentest is mandatory after significant changes, such as:

• Replacement of the application
• Implementation of a new version
• Migration of web servers
• Database migration

Based on a risk assessment, it is recommended to run a pentest multiple times a year to properly respond to new threats. This proactive testing policy helps identify and remediate potential vulnerabilities in time, continuously strengthening the security of DigiD implementations.

A DigiD pentest and a regular pentest differ mainly in scope and requirements. A regular pentest examines the security of a system, application or network for vulnerabilities, with the approach and methodology depending on the specific needs of the client. This can range from black-box testing (without prior knowledge) to white-box testing (with full access to the code and infrastructure).

A DigiD pentest, on the other hand, is a strictly regulated security test specifically for organizations that integrate DigiD into their systems. This pentest must meet the requirements of Logius, the manager of DigiD, and focuses on the security of DigiD connections and the protection of personal data. The test methodology and reporting must meet established guidelines, and the results are assessed by Logius before a system is approved for using DigiD.

A DigiD pentest is a thorough security test in which an ethical hacker searches for vulnerabilities in the DigiD connection. The pentest must meet the guidelines of Logius, which has the requirements drawn up by NOREA. The results of this pentest are included in the DigiD Assessment.

A DigiD assessment is a broader audit that evaluates not only the technical security (including the pentest), but also the organizational and procedural measures surrounding DigiD use. This assessment is mandatory and must be carried out by an auditor accredited by Logius.

A DigiD pentest is therefore part of the DigiD assessment.

Good preparation for a DigiD pentest helps an organization discover vulnerabilities early and ensures that the annual DigiD assessment runs smoothly.

• Gather documentation: Make it easier for the pentesters by having potentially relevant documents ready, such as architecture documents, network diagrams and configurations. If a previous pentest or security scan was ever carried out, provide it as a reference.
• Arrange access and a test environment: Make sure pentesters have access to a test environment that resembles the production environment as closely as possible. Also give the pentester(s) access to a test account. It is of course wise to test in a test environment, in case something ever breaks.

Failing to meet DigiD requirements can have several serious consequences for organizations:

• Suspension or termination of DigiD services: If an organization does not submit its annual assessment report on time, Logius can suspend or even deactivate the DigiD connection. This means the organization can no longer use DigiD for its services.
• Formal warning: If the assessment report is not delivered on time, Logius sends a registered warning letter. This puts the organization in default and gives it a final chance to meet its obligations.
• Reputational damage: Failing to comply with DigiD standards can lead to negative publicity and reduced trust from customers and partners in the organization.