Context:

Due to the large number of cyber-attacks at international and national levels (Colombia), preventive mechanisms and procedures have been triggered by organizations in order to counteract vulnerabilities in information security. The issue studied by this project arises from the need to make a proposal to the DIAN information security office to implement and follow up on the MinTIC Online Government Strategy in the Information Security and Privacy component, through the institutional information security policy and through this knowledge base model for audits in web services, applied to a particular prototype.

Method:

The general methodology for the knowledge base model the first corresponds to the collection, processing, and purification of the base, and the second corresponds to the systematization process of the proposed model. OpenKM (an open software) was implemented to support the knowledge base. For the development of the audit, it is important to keep in mind that, within the general methodology, a series of guides were included in each of the phases of the model. The project uses standards, good practices, tools, and professional advice such as ISO27000, OSSTMM, OWASP, JUnit, and the Risk Management and Audit guides issued by MinTIC. For the development of the prototype with the presented WS, the OPENUP method was used. The implementation was limited to the construction of two HTTP methods: GET and POST for consultation and information entry actions.

Results:

With this project, it was possible to create a knowledge base model implemented on OpenKM, executing a web services security audit with SQL Injection on an organizational prototype.

Conclusions:

It must be taken into account that there will never be a 100% secure infrastructure, since there will always be risks on the platforms due to the changing nature of the attacks. However, there will always be alternatives such as this base model of information security auditing to avoid or mitigate such risks or attacks.

        · resumo em Espanhol     · texto em Espanhol     · Espanhol ( pdf )