Desarrollo de un módulo de seguridad basado en OSSTMM y OWASP para mitigar y controlar la seguridad en aplicaciones web caso de estudio: Sistema Médico Escuela Superior Politécnica de Chimborazo.

Abstract

In the current research the need to face the threats or vulnerabilities that present the systems for the web is exposed, these attacks are aimed at the theft of information that host the databases of these systems. For this reason it is necessary to implement security metrics to ensure the security of information that is the vital organ for any entity, therefore it was developed a security module for web systems which was applied in the medical system of the ESPOCH. This module aims to ensure the integrity of the data held by these systems in their databases, for the development of the proposed module was based on the OWASP and OSSTM methodologies. The security module is made up of four components, which in turn are classified into two groups according to the functionality that each one fulfills, thus we have the components that interact directly with the system and the components that are applied to the production servers. For the development of the components of the first module, the Angular Framework was used, these components act as an intermediate layer between the user view and the business logic of the medical system. For the second group of components, the implementation of SSL certificates and a script on the database server that allows the creation of backup copies of the medical system's database were carried out. For the evaluation of the implemented security module, four test environments were created, i.e. one for each component of the developed module, and the data obtained was analyzed using the T-Student statistical method. For this case study we worked with a confidence level of 95%, with a significance level equal to 0.05, as a result of the T statistic we obtained a value of P(T<=t) two-tailed equal to 6.88224E-06 which in comparison to the significance level shows a significant difference with which it is proved that the implementation of the developed module allows improving the security in the health system of ESPOCH.