Diseño e implementación de un módulo de seguridad basado en owasp para mitigar y controlar la seguridad en servidores web

Abstract

The objective of this research was to implement a security module based on OWASP to mitigate and control the security of web servers, for which four scenarios with vulnerability and four scenarios with the security module were developed for each type of vulnerability. The research methodology used was the explanatory method, because the process applied was to observe the different scenarios and then perform the same scenarios with the security module. To identify the vulnerabilities, the most common cyber-attacks currently occurring were verified, such as Remote Code Execution (REC) with 40% - 60%, Brute Force 6% - 25%, Denial of Services (DDos) with 25% - 50%, for this reason two types of vulnerability scenarios were developed and with security modules specifically for each one, three servers were used, which are Tomcat, IIS and Apache2. The purpose of this module is to ensure the integrity and confidentiality of web services and applications hosted on web servers. To evaluate the effectiveness of the security module, four vulnerability-less scenarios were created in which the following solutions were implemented Apache ActiveMQ updates on Windows Server 2022, OS updates, security updates and configuration changes on the IIS server, creation of security rules and access control logs on the Apache2 web server, Spring Framework update with the Tomcat server. It is concluded that the present research mitigated the vulnerabilities in each of the scenarios with the security module, no malicious actions could be performed, and no web servers were accessed. It is recommended that future research continue to explore new threats, mitigation techniques and security solutions.