Generación de políticas para la gestión de riesgos de seguridad en el desarrollo de software.

Abstract

The objective was to generate policies for security risk management in software development at the National Judicial Council, the investigation begins by generating a test environment in which two prototype extensions are configured on the same server, the same ones are configured, one applying the policies generated and another without applying the policies. As a result of the research, when applying the policies and using them during the software development stage, it was possible to reduce from 39.2% to 12.5% in the tests performed, in order to continue to mitigate the existing vulnerabilities in the applications developed. When applying the policies toward a test prototype, before being put into production, it was observed that, without security policies, the application is less certain when policies are implemented. It is recommended that the Judiciary Council apply, through the development Sub-Management, the policies generated to manage and improve the security of its sensitive computer assets, and to improve and mitigate vulnerabilities in its applications.