In a landscape where cyber threats are evolving rapidly and the digital infrastructures of health agencies are becoming strategic targets, securing web applications is a fundamental operational challenge. Protecting health data, ensuring service continuity for high-visibility platforms, and complying with regulatory requirements demand rigorous and tailored technological choices. In this context, the use of a SaaS-based Web Application Firewall (WAF) – which is high-performing, flexible, and transparent – is an essential tool for building a robust security posture tailored to the business realities of the public sector.
In this interview, Stéphane Nardy, Head of Information Systems Security at Santé Publique France, shares his insights on the migration to OGO Security’s WAF solution. In this interview, he discusses the criteria for selecting a solution suited to a multi-application environment, the challenges of visibility and control in a highly exposed setting, and the importance of technical support to ensure a smooth transition without service disruption.
What are the main challenges of your role as CISO, and how do you approach protecting your sites and data?
“We are a public health agency under the Ministry of Health. Protecting the information systems we operate is therefore a top priority, particularly given the sensitivity of the health data we process. This data supports epidemiological surveillance, public health crisis management, and public prevention campaigns.
In particular, we host high-visibility platforms such as “Smoke-free month” and “Eat and move,” which are regularly targeted by defacement or DDoS attacks. This type of digital activism specifically targets campaigns related to sexual health or LGBT+ rights, which can provoke hostile reactions from certain groups.
At the same time, we must protect ourselves against attacks targeting health data, often motivated by espionage or the intent to disrupt response capabilities during a crisis. We are therefore confronted with a spectrum of attackers ranging from opportunistic activists to more organized threats, including state-sponsored ones.”
Healthcare organizations, as custodians of sensitive medical data and critical infrastructure, are strategic targets for various malicious actors. The digital attack surface includes both highly sensitive business applications and high-traffic public websites, which are exposed to threats such as SQL injection, cross-site scripting (XSS), credential stuffing, and distributed denial-of-service (DDoS) attacks. A Web Application Firewall (WAF) acts here as a Layer 7 application filter (HTTP/HTTPS layer), capable of identifying and blocking in real time malicious requests that aim to compromise the integrity of exposed services or exfiltrate data.
In an environment where internal technical resources are often shared between business projects and communication channels, web cybersecurity must incorporate solutions that offer a high level of threat detection, granular security rules, and detailed visibility into incoming and outgoing traffic. Modern WAFs rely on dynamic signatures, behavioral analysis, false-positive management, and tight integration with DevSecOps environments via APIs. For public healthcare institutions, the continuous availability of critical applications, regulatory compliance (e.g., GDPR, SecNumCloud certification), and the traceability of security events are non-negotiable requirements. A centralized web protection architecture is therefore an essential component of a robust cybersecurity posture.
Why did you choose to partner with OGO Security for your web security project?
“Since the health crisis began, we’ve been using a cloud-based WAF that was urgently deployed during the first wave of the pandemic to replace an on-premises solution that had been planned initially but became inoperable due to licensing constraints and uncontrolled costs.
This cloud version met our initial needs, particularly the protection of critical applications hosted across different environments. However, several limitations became apparent. In the event of an incident, log analysis was labor-intensive, with very limited visibility into HTTP frames and suspicious behavior. In late 2024, our service provider announced that this version would reach end-of-life in February 2025. The new platform required a complex migration, with no option to automatically migrate existing configurations, and featured reduced functionality, particularly in terms of API integration. We therefore decided to evaluate this solution, which we had identified during a presentation by the State Procurement Directorate. As it turned out, our managed services provider was also familiar with this solution.”
The selection of a SaaS-based web protection solution for a public health agency is based on technical criteria directly related to the nature of the threats, the IT architecture, and service continuity requirements. From a technical standpoint, a SaaS-based WAF solution must ensure comprehensive coverage of HTTP/HTTPS traffic, including deep packet inspection (DPI), the ability to process TLS/SSL encryption without interrupting traffic flow, and granular management of security policies. Interoperability via RESTful APIs – essential in a DevSecOps context – also enables the automation of deployments, configuration monitoring, and the orchestration of security policies across multiple sites.
The operational effectiveness of a SaaS WAF also depends on its ability to provide actionable activity logs in real time for detection, correlation, and investigation. A platform that offers detailed visibility into HTTP frames, response codes, headers, and request parameters facilitates post-incident analysis without requiring advanced network expertise. The ability to segment security rules by application, customize exceptions without unintended consequences, and track key metrics (block rates, false positives, and critical paths accessed) is essential for managing application risks. In a demanding regulatory environment, complete traceability, the resilience of the hosting infrastructure, and the auditability of actions on the management console are key factors in evaluating a web cybersecurity solution.
Can you describe the benefits and results observed following the implementation of the OGO solution?
“The migration to OGO Security took place over three weeks in early 2025, with the goal of completing the switchover by the end of January. Thanks to thorough preparation – particularly by leveraging APIs – we were able to automate a large portion of the initial configuration. The sites were migrated in several batches, with functional validation by the TMA teams, which allowed for a gradual and controlled rollout.
The OGO solution was very quick to deploy. It’s a SaaS platform with a well-designed level of abstraction: the user applies a global security policy and then refines it with contextual rules without having to juggle multiple levels of protection.
This model simplifies day-to-day management. The console provides detailed visibility into traffic: rejection rates, HTTP codes, most-visited URLs, and detailed logs—all of which can be leveraged in real time by project teams, even those without expertise in WAF cybersecurity. The level of granularity is sufficient for my analysts, while remaining understandable to generalist technical staff.
Unlike on-premises or legacy WAFs, OGO does not require highly specialized skills for deployment or configuration. The interface is intuitive and provides good visibility into application behavior, without the risk of critical side effects with every change.”
A rapid, seamless migration to a new WAF solution is a strategic priority for any organization exposed to cyber risks, particularly in the context of a public health crisis. The integrity and availability of critical web applications must not be compromised during the transition phase. The use of open, well-documented APIs facilitates the automation of configuration tasks while reducing the time required to manually rebuild security rules. Organizing the switchover in batches allows for incremental validation of application flows and filtering policies, while limiting the risk of functional regression on production sites. Close coordination with application maintenance teams ensures continuous monitoring of application behavior during the transition.
An architecture based on a unified security model – without the multi-tiered management approach proposed by OGO Security – eliminates the need for complex trade-offs between heterogeneous security profiles. This approach relies on a single filtering policy, supplemented by advanced configuration options tailored to the specific requirements of the protected applications. Exception handling and rule customization are performed in a targeted manner, with a controlled impact on business workflows. This approach significantly reduces the risk of unexpected blockages or unanticipated behavior, while maintaining a high level of protection against the most common application attack vectors (injections, cross-site request forgery, and attempts to bypass controls).
This type of platform also provides complete visibility into web traffic passing through the WAF. Technical metrics such as HTTP responses, blocked requests, requested resources, and application errors are directly accessible from a unified interface, without the need for external decryption or correlation tools. This native visibility covers all protected domains and applications, facilitating rapid diagnostics, the detection of abnormal behavior, and faster incident response times. In this context, the interface is designed to be usable by both advanced technical users and project teams, promoting operational autonomy without reliance on specialized network expertise.
Which aspects of the OGO solution and the team support do you find most beneficial?
“The responsiveness of the OGO teams is a real strength. The support is seamless, with knowledgeable and technically skilled representatives who are always available. We’ve improved our ability to observe and analyze: HTTP frames are easy to read, and the logs are actionable – which wasn’t the case with our previous solution. This visibility facilitates both audits and corrective actions.”
In the context of a high-impact application security migration, the quality of technical support and the availability of the vendor’s teams are key factors. A responsive team – capable of quickly analyzing unexpected behavior, validating configuration assumptions, or proposing targeted adjustments – significantly reduces service interruptions and deployment errors. The ability to work with experts who understand both the product’s architecture and production constraints enables the smooth execution of critical steps, such as launching high-traffic websites or securing sensitive data flows. A collaborative approach between the vendor and the client facilitates the adaptation of security rules to specific business needs without exposing applications to functional degradation.
Transparency regarding the security mechanisms deployed is also a prerequisite in environments subject to high regulatory or operational sensitivity. An effective WAF solution must provide direct access to all logs, packets, event logs, and blocking decisions, with sufficient clarity to document audits and justify filtering decisions. This ability to track security actions in real time, correlate network behavior with application errors, or identify blocked attacks is essential for building trust among internal stakeholders. Transparency regarding the decisions made by the security engine also fosters a proactive approach to hardening and adjusting policies, while ensuring that security incidents are clearly reported to non-technical users.
If you had to summarize your experience with OGO Security, what would you say?
“Simplicity, clarity, transparency”
