Aplicación de controles del estándar iso 27002 para la prevención de vulnerabilidades en la privacidad de datos en servicios web del framework laravel

Abstract

This research project has as main goal the application of ISO 27002 and ISO 27701 guidelines controls in order to prevent data privacy vulnerabilities among Laravel Framework web services and, through its application, the generation of a specific improvement guidance manual. For the theoretical development it is made a review of related works, in which is applicated the Action Research methodology. With all the basic concepts knowns, the methodology was applied counting on ground basis for its execution like: diagnosis, planning future actions, evaluation of these actions and identification of methodology application findings.

After identifying SECAP initial status, privacy data vulnerabilities analysis was performed. Also, the evaluation of data, access systems and networking threats; obtaining a very high measured risk.

After all the analysis and evaluations, it was defined policies that included specific measures in order to mitigate any identified threats over informatic goods. Every one of the measures is based on the probability of occurrence of a malicious even and the related risk. All of that to reduce the total weight of the measured risk.

As part of the results of the analysis, it was found several vulnerabilities on Authentication module web services, as part of the studied module. Based on those vulnerabilities and the related threats, it was developed an improvement policies plan, in order to SECAP can prevent all found vulnerabilities.