MARCO DE REFERENCIA PARA EL DESARROLLO DE UNA AUDITORÍA DE SEGURIDAD INFORMÁTICA EN APLICACIONES ANDROID.

Abstract

The present work is focused on proposing a frame of reference for the development of an IT security audit in Android applications, specifying procedures and adjusting nomenclatures that facilitate the auditors to define the impact, the probability that a vulnerability will materialize and the level security of the safeguards found within the frequent vulnerabilities in Android applications. For this, a bibliometric analysis of the main concepts on the phases of an audit focused on information technologies, risk treatments focused on information technologies and methodologies focused on the analysis of failures in mobile applications is carried out, with the result obtained They selected three academic articles which were chosen because they are based on recognized and proven methodologies: the audit and information systems assurance guide proposed by the Isaca, the risk analysis and management methodology of the Information Systems (Magerit ) and the Owasp Mobile Security Project security analysis methodologies, which serve as the basis for the construction of the proposed framework, which exposes the stages and procedures that must be followed within an audit, also with the information obtained from the elaboration of the frame of reference you get a li This is the checklist with the most frequent failures that should be analyzed with the option to classify their probability of occurrence and specify the level of implementation of the safeguards found. The validation of this work is done through the technique of a focus group with a qualitative approach, which facilitated the participation of five professionals in the area who provided their opinions and points of view about the feasibility of using the proposed framework. In the end the acceptance of one hundred percent of the participants was obtained considering it a viable alternative to perform a security audit in Android applications.