Implementación y evaluación de un sistema de seguridad anti-phishing para protección de la información utilizando un Firewall en procedimientos académicos en línea para el Instituto Superior Tecnológico Riobamba.

Abstract

The research objective was to implement and evaluate an anti-phishing security system to give protection to data at The Institute of Higher Technology Riobamba, implementing the ISO norms 27001. Testing was carried out on the computing platform in order to detect vulnerabilities, using a security system based on ISO 27001 norm for its prevention. The detection of vulnerabilities was based on 5 security risks found through Open Source, using scanning and exploitation tools such as Nessus, Vega, BurpSuite and Zenmap, Kali Linux (metasploit), which allowed the identification of security failures like: malicious code injection, authentication loss, sensitive data exposure, loss of access control, incorrect security control, use of components with known vulnerabilities and insufficient register and monitoring. Moreover, it was identified that the computing platform registered all 8 established vulnerabilities. It was concluded that the platform could have been 100% affected, therefore a security plan including best practices and guidance was designed, taking into account the vulnerabilities found, such plan was implemented and tested for a trial period of one to two months, resulting in a significant improvement in the level of security, reducing from 7 to 2 the number of vulnerabilities of the platform. The implementation of the security plan allowed a 75% improvement of the institution’s platform. The continuity of the implementation of security policies is recommended, in order to generate a preventive culture within the staff members and prevent risky situations in the future.