Methods for Testing, Assessment and Analysis of the Security of University Information Systems

Венко Андонов

doi:10.37075/RP.2023.5.05

Authors

Assist. Prof. Dr Venko Andonov Department of Informatics, Faculty of Applied Informatics and Statistics, UNWE Author

DOI:

https://doi.org/10.37075/RP.2023.5.05

Keywords:

Software, Information security, Security testing, Vulnerabilities, Cybersecurity

I23, M15

Abstract

The methods for testing, evaluating and analyzing the security of university information systems aim to build a unified framework that leads to an increase in information security in this type of institution, which is characterized by the administration of a huge volume of sensitive information of a diverse nature. Security testing is a multifaceted process involving steps to ensure the safety of systems in their entirety. The proposed methods have been tested with three systems of the University of National and World Economy, and one of them is presented here; and conclusions are drawn to increase security and include the described procedures as a permanent practice.

References

Bertoglio, Daniel Dalalana & Zorzo, Avelino Francisco (2017). Overview and open issues on penetration test. Journal of the Brazilian Computer Society, 23(1), 1-16. DOI: https://doi.org/10.1186/s13173-017-0051-1

Li, Kaixuan, Chen, Sen, Fan, Lingling, Feng, Ruitao, Liu, Han, Liu, Chengwei, Liu, Yang, & Chen, Yixiang (2023). Comparison and Evaluation on Static Application Security Testing (SAST) Tools for Java. ESEC/FSE 2023 Research Papers. DOI: https://doi.org/10.1145/3611643.3616262

Severns, R. (2021). Dynamic Application Security Testing: Overview and Tooling. URL: https://www.stackhawk.com/blog/dynamic-application-security-testing-overview/ (accessed 2023-05-26)

Comparitech (2023). What is IAST? (Interactive Application Security Testing). URL: https://www.comparitech.com/net-admin/interactiveapplication-security-testing-iast/ (accessed 2023-10-12)

Myers, B. (2021). What is Software Composition Analysis (SCA)? SCA Scanning Overview and Tooling Guide. URL: https://www.stackhawk.com/blog/software-composition-analysis-sca-overview-and-tooling-guide/ (accessed 2023-06-11)

CIS (2021). How Configuration Assessments Help Improve Cyber Defenses. URL: https://www.csoonline.com/article/3612398/howconfiguration-assessments-help-improve-cyber-defenses.html (accessed 2023-10-30)

Alvarenga, G. (2023). Runtime Application Self-Protection (RASP). URL: https://www.crowdstrike.com/cybersecurity-101/cloudsecurity/runtime-application-self-protection-rasp/ (accessed 2023-11-22)

Certitude Security (2020). What Are Blue Teams and Blue Team Exercises?. URL: https://www.certitudesecurity.com/blog/analysis-andassessments/what-are-blue-teams-and-blue-team-exercises/ (accessed 2023-09-18)

Niezen, F., Eloff, J.H.P., & von Solms, R. (2018). An approach to minimizing legal and reputational risk in Red Team exercises. Computers & Security, 78, 35-47.

Ge, M., Bang, Y., & Kim, D. (2015). Continuous Monitoring and Assessment of Cybersecurity Risks in Large Organizations. 48th Hawaii International Conference on System Sciences, pp. 5007-5016.

Christey, S. (2008). CWE - A Comparison of the CWE Development and Research Views. URL: https://cwe.mitre.org/documents/views/view-comparison.html (accessed 2023-07-19)

Halfond, W. G., Viegas, J., & Orso, A. (2006). A Classification of SQL Injection Attacks and Countermeasures. Proceedings of the IEEE International Symposium on Secure Software Engineering.

Kirda, E., Kruegel, C., Vigna, G., Jovanovic, N., & Balduzzi, M. (2009). Noxes: a client-side solution for mitigating cross-site scripting attacks. Computers & Security. DOI: https://doi.org/10.1016/j.cose.2009.04.008

Barth, A., Jackson, C., & Mitchell, J. C. (2008). Robust defenses for cross-site request forgery. Proceedings of the 15th ACM conference on Computer and communications security. DOI: https://doi.org/10.1145/1455770.1455782