Propuesta de implementación de un modelo para la reducción de riesgos de seguridad informática en servicios web de la ESPOCH

Abstract

The research Proposal Implementation of a Model for reduction of Computer Security Risks in Web Services ESPOCH held in Riobamba city. It helps to reduce security risks in Web Services of Escuela Superior Politécnica de Chimborazo. The scientific method was used because it uses steps to obtain knowledge and valid and reliable results. It was considered a problem and internal flaw the vulnerability that currently present due to software defects, human resource DTIC (Department of Information Technology and Communication). It did not meet the appropriate processes when modifying web services. Due to it did not keep constant and consistent training with the roles these factors have. The indicator values were compared number of vulnerabilities and inferential statistics was applied to test the hypothesis. The tool used was VEGA, which allowed scan web vulnerabilities For what the relevant assets, threats, safeguards were identified. URLs (Uniform Resource Locator) of the Web Services ESPOCH, impacts were scanned and the level of risk was measured. The results based on the number of vulnerabilities were compared, determining that the implementation of the model for risk reduction helped reduce vulnerabilities found. Also, it mitigated the same as found in the preliminary analysis of the research. The vulnerabilities were high 416, medium 175 and low 1475, three of the most common vulnerabilities were: SQL (Structured Query Language) Injection, PHP (Hypertext Preprocessor) Error Detected and Directory Listing Detected. It is recommended to apply Improvement Plan proposed to minimize the Risks.