PROPUESTA DE UNA METODOLOGÍA DE PRUEBAS DE PENETRACIÓN ORIENTADA A RIESGOS

Abstract

The security of information has become in most organizations an important and indispensable aspect for their operations. That is why today there are several methodologies that guide auditors to perform tests and apply metrics; in order to analyze controls and procedures that verify said security. The present investigation carries out a descriptive study, with a qualitative approach, of the OSSTMM, OWASP, PTES, ISSAF and CVSS methodologies in order to make a new proposal that compiles the best practices with both a technical and risk approach. For this, an exploration of all the characteristics of the aforementioned methodologies was carried out using bibliographic review, interviews and expert judgments; finding procedures and standards that guide the effective performance of penetration tests. As a result, a risk-oriented methodology proposal is obtained, which contains four stages: the first, regarding the agreement, scope, information gathering; the second to the execution, the third that deals with the risk assessment and the last one that contemplates the generation of reports. The same, is considered a contribution for the technological auditors since in addition to informing on technical aspects, it also does it, on approaches of risks prioritizing them through levels of incidence or of gravity on the objectives of the company.