SECURITY PLAN FOR WEB PLATFORMS USING ISO 27001 STANDARDS AND CONSIDERING THE OWASP TOP 10-2017
DOI:
https://doi.org/10.29076/issn.2528-7737vol15iss40.2022pp1-15pKeywords:
ISO 27001, OWASP Top 10-2017, security plan, web platform, vulnerabilitiesAbstract
The present investigation was carried out on the web platform of the services of the Fire Department of the Municipal GAD of Santo Domingo with the objective of detecting vulnerabilities and implementing a security plan using ISO 27001 standards considering the list of security risks of OWASP Top 10- 2017, to reduce, mitigate or eliminate them. The process for penetration testing and exploitation of web vulnerabilities was carried out in 4 phases: information gathering, vulnerability analysis, exploitation and report generation. For the tests, the following tools were used: Nessus, Vega, BurpSuite, BeEF, Metasploit, Synflood, Hydra and Zenmap. As a result, it was determined that the web platform was vulnerable to: injection (A1:2017), loss of authentication (A2:2017), exposure of sensitive data (A3:2017), loss of access control (A5:2017), configuration of incorrect security (A6:2017), use of components with known vulnerabilities (A9:2017), and insufficient logging and monitoring (A10:2017). Based on this evaluation, a security plan for the web platform was created and implemented. Vulnerability tests were carried out on 2 prototypes (Prototype I: without a security plan, Prototype II: considering the security plan) from which an improvement in the security of the web platform was obtained by 75%.
Downloads
References
Alcorn, W. (2021). Obtenido de https://tools.kali.org/exploitation-tools/beef-xss
AlGhamdi, S. K., & Vlahu, E. (2020). Information security governance challenges and critical success factors: Systematic review. Elsevier, 99. doi:https://doi.org/10.1016/j.cose.2020.102030
Ballen, A., Ayala, C., & Sierra, A. (2017). Análisis de vulnerabilidades en aplicaciones Web desarrolladas en PHP Versión 5.6.24 con base de datos MYSQL Versión 5.0.11 a partir de ataques SQL Inyección. Bucaramanga: Universidad Cooperativa de Colombia, Facultad de Ingenierías, Ingeniería de Sistemas.
Comando It. (2021). Obtenido de https://comandoit.com/ataque-syn-flooding-con-metasploit/
Cortez, D. (2017). Hydra - Kali Linux, una excelente herramienta de Auditoria. . Obtenido de https://www.seguridadyfirewall.cl/2017/03/hydra-kali-linux-una-excelente.html
Cuerpo de Bomberos Santo Domingo. (2021). Obtenido de https://bomberossantodomingo.gob.ec/
Gaba, J., & Kumar, M. (2013). Implementation of steganography using CES technique. IEEE Second International Conference on Image Information Processing (ICIIP) (págs. 395-399). Shimla: IEEE.
Google. (2021). Obtenido de https://www.google.com/intl/es-419/chrome/
INEN. (2015). TECNOLOGIAS DE LA INFORMACION — TECNICAS DE SEGURIDAD — SISTEMAS DE GESTION DE SEGURIDAD DE LA INFORMACION - REQUISITOS.
ISOTools. (2021). Obtenido de https://www.isotools.org/normas/riesgos-y-seguridad/iso-27001/
Kali linux. (2021). Kali. Obtenido de https://www.kali.org/docs/introduction/what-is-kali-linux/
Ladino, M., Villa, P., & López, A. (2011). Fundamentos de iso 27001 y su aplicación en las empresas. 47(17), 334-339.
Mozilla. (2021). Obtenido de https://www.mozilla.org/es-ES/firefox/new/
Normas ISO. (2020). Obtenido de https://www.normas-iso.com/iso-27001/
OWASP. (2017). OWASP Top 10 - 2017. Obtenido de https://wiki.owasp.org/images/5/5e/OWASP-Top-10-2017-es.pdf
OWASP. (2021). Obtenido de https://owasp.org/
Panday, R., & Pandey, V. (2016). Cryptography & security implementation in network computing environments. 3rd Computing for Sustainable Global Development (INDIACom) (págs. 3136-3140). IEEE.
PortSwigger. (2021). Obtenido de https://portswigger.net/burp
Postor, H. (2020). Mapping the OWASP Top Ten to Blockchain. Elsevier, 177, 613-617. doi:https://doi.org/10.1016/j.procs.2020.10.087
Puime, J. (2009). El ciberespionaje y la ciberseguridad. In La violencia del siglo XXI. Nuevas dimensiones de la guerra (págs. 45-76). Instituto Español de Estudios Estratégicos.
Rapid7. (2021). Obtenido de https://www.metasploit.com/
Rojas, O., Medina, Y., & Bautista, D. (2016). Pentesting empleando técnicas de ethical hacking en redes IPv5. 11, págs. 79-96. Rev. Ingenio UFPSO.
Santiago, E., & Allende, J. (2017). RIESGOS DE CIBERSEGURIDAD EN LAS EMPRESAS. Madrid: Revista Tecnología y desarrollo.
Solarte, F., Rosero, E., & Benavides, M. (2015). Metodología de análisis y evaluación de riesgos aplicados a la seguridad informática y de información bajo la norma ISO/IEC 27001. 28. Escuela Superior Politécnica del Litoral (ESPOL).
Sqlmap. (2021). Obtenido de https://sqlmap.org/
Subgraph. (2021). Obtenido de https://subgraph.com/vega/
Tenable. (2021). Obtenido de https://es-la.tenable.com/products/nessus
Toledo, A. (2014). Test de penetración Exploración de vulnerabilidades con Metasploit-framework.
Wireshark. (2021). Obtenido de https://www.wireshark.org/
Zenmap. (2021). Obtenido de https://nmap.org/zenmap/
Downloads
Published
Issue
Section
License
Authors can keep the copyright, granting the journal right of first publication. Alternatively, authors can transfer copyright to the journal, which allow authors non-commercial use of the work, including the right to place it in a file open access.
