Análisis de vulnerabilidades de la aplicación Quipux mediante la herramienta OWASP ZAP aplicado al Gobierno Autónomo Descentralizado de la provincia del Carchi
No Thumbnail Available
Date
2023
Journal Title
Journal ISSN
Volume Title
Publisher
PUCE - Ibarra
Abstract
La seguridad de la información busca salvaguardar la integridad de los datos, prevenir accesos no autorizados a sistemas y evitar la divulgación o compromiso de los mismos. En este proyecto de investigación se busca la mitigación de vulnerabilidades que existen en una de las aplicaciones internas que se encuentran en ejecución en el Gobierno Autónomo Descentralizado de la Provincia del Carchi (GADPC). La metodología adoptada abarca diversas etapas. En primer lugar, se analiza la gestión de la seguridad en el entorno de esta entidad gubernamental para comprender su enfoque y necesidades. Posteriormente, se realiza un análisis exhaustivo del código fuente de Quipux, empleando las técnicas y estándares establecidos por OWASP. La síntesis de resultados se basa en la revisión de los informes de escaneo, los cuales detallan las vulnerabilidades y errores identificados en la aplicación de gestión. A través de esta evaluación, se logra determinar que la ejecución de un piloto utilizando la herramienta ZAP de OWASP que permite una identificación precisa de las vulnerabilidades presentes en Quipux, de acuerdo con los niveles críticos de seguridad que imperan en la aplicación web sometida a análisis. En este sentido, el enfoque propuesto revela áreas de mejora en términos de seguridad y ofrece recomendaciones concretas para mitigar las vulnerabilidades descubiertas en la aplicación utilizada por el GADPC.
Information security seeks to safeguard the integrity of data, prevent unauthorized access to systems and avoid disclosure or compromise. This research project seeks to mitigate vulnerabilities that exist in one of the internal applications that are being implemented in the Decentralized Autonomous Government of the Province of Carchi (GADPC). The methodology adopted includes several stages. First, the security management in the environment of this governmental entity is analyzed to understand its approach and needs. Subsequently, an exhaustive analysis of the Quipux source code is carried out, using the techniques and standards established by OWASP. The synthesis of results is based on the review of the scan reports, which detail the vulnerabilities and errors identified in the management application. Through this evaluation, it is possible to determine that the execution of a pilot using the OWASP ZAP tool allows an accurate identification of the vulnerabilities present in Quipux, according to the critical security levels prevailing in the web application under analysis. In this sense, the proposed approach reveals areas for improvement in terms of security and offers concrete recommendations to mitigate the vulnerabilities discovered in the application used by GADPC.
Information security seeks to safeguard the integrity of data, prevent unauthorized access to systems and avoid disclosure or compromise. This research project seeks to mitigate vulnerabilities that exist in one of the internal applications that are being implemented in the Decentralized Autonomous Government of the Province of Carchi (GADPC). The methodology adopted includes several stages. First, the security management in the environment of this governmental entity is analyzed to understand its approach and needs. Subsequently, an exhaustive analysis of the Quipux source code is carried out, using the techniques and standards established by OWASP. The synthesis of results is based on the review of the scan reports, which detail the vulnerabilities and errors identified in the management application. Through this evaluation, it is possible to determine that the execution of a pilot using the OWASP ZAP tool allows an accurate identification of the vulnerabilities present in Quipux, according to the critical security levels prevailing in the web application under analysis. In this sense, the proposed approach reveals areas for improvement in terms of security and offers concrete recommendations to mitigate the vulnerabilities discovered in the application used by GADPC.
Description
Keywords
Owasp zap, Vulnerabilidades, Quipux, Scanning report