Guía metodológica para la implementación de software seguro y protocolos de seguridad en sistemas de redes de datos.

Abstract

For the development of this project, a methodological guide aimed at implementing secure software and security protocols in network systems data for this three existing methodologies that are fundamental, recognized and endorsed by international organizations will be analyzed was performed, all these methodologies are oriented and framed in the study of systems WAN networks to verify security flaws.

The OSSTMM methodology, is aimed at testing and safety analysis, developed by the ISECOM organization, the Institute for Security and Open Methodologies, which is one of the most complete professional standards and commonly used in Security Audits to check Security Systems from the Internet [1]. The following methodology will be element of the research is the ISSAF, this methodology consists of a structure of security analysis in multiple domains and specific details of test or tests for each of these. It aims to provide very detailed procedures for the testing of information systems that reflect real situations [2]. Finally, in methodologies it is concerned, the OWASP emphasizes web security audit, open and collaborative, oriented security analysis Web applications, and used as a benchmark in security audits for scope of analysis used and categorize the top 10 currently existing vulnerabilities in web applications [3].

The methodological guide includes components of ISO / IEC standard, making a detailed study of the ISO / IEC-27000, 27001, 27002 standards are one of the standards guaranteed by a set of procedures and instructions of how to implement a system management information security [4]. They should also be taken as a reference common Criteria (Common Criteria) that will allow to have a much more detailed analysis of all requirements panorama to which the software developer must be upheld to maintain profiles and standards of quality and safety that the current environment requires, supported standard components under ISO / IEC 15408 [5].

Likewise, the components and technologies that currently use a WAN, in order to analyze and determine by field measurements, security holes that exist in these networks, then some field tests were conducted with where it determined was analyzed the vulnerability of some web applications from universities in the region as the UIS, UPA, UFPS and UDES, all with the help of Kali Linux operating system and turn Omesar and OWASP-ZAP software, which allowed the development of a guide taking into account factors, methodologies and standards mentioned above