DISEÑO DE UN ESQUEMA DE SEGURIDAD PARA LA AUTENTICACIÓN DE TELÉFONOS INTELIGENTES ANDROID EN APLICACIONES WEB CORPORATIVAS, QUE UTILIZAN UN SERVICIO DE DIRECTORIO

Abstract

Information is one of the most important intangible assets of organizations, the current strategy is oriented to the prevention and early detection of threats and vulnerabilities on this resource, the present work develops a security scheme to access in a controlled way the organizational web application from smartphones that operate with the Android operating system; this security mechanism proposes the use of a new authentication model that captures the IMEI number as the unique identifier of the device, this attribute is added to the traditional user request and password for access to the web applications, in effect, the information is authenticates with the user's data previously stored in the Active Directory of the organization, using a web server as an intermediary and a proxy server in the perimeter of the network. The results obtained with the tool for ZAP penetration and security tests and the OWASP methodology, demonstrated that the proposed security model contributes to minimize the risks by A2: 2017-Broken authentication and A5: 2017-Broken access control according to OWASP Top 10-2017 in the organizational intranet; These experimental results indicate that the security model for authenticating users in an organizational network is capable of supporting a variety of Spoofing-Looping, brute force or dictionary attacks, making it more efficient and less vulnerable to guessin attacks.