A Comprehensive Analysis of Cybersecurity Infrastructure in Academic Environments

Holger Jorge Santillan Carranza; Julio Andres Arevalo Satan; Peregrina Maria Amparo Wong Wong

doi:10.15517/ri.v35i1.60075

A Comprehensive Analysis of Cybersecurity Infrastructure in Academic Environments

Título traducido de la contribución: Un Análisis Integral de la Infraestructura de Ciberseguridad en Entornos Académicos

Holger Jorge Santillan Carranza
, Julio Andres Arevalo Satan
, Peregrina Maria Amparo Wong Wong

Grupo de Investigación en Sistemas de Telecomunicaciones (GISTEL)

Producción científica: Contribución a una revista › Artículo

Resumen

Este trabajo realiza un análisis exhaustivo de los sistemas de ciberseguridad en los ambientes académicos: “www. ups. edu. ec”, “cas. ups. edu. ec”, “virtual. ups. edu. ec” y “dspace. ups. edu. ec”, de la Universidad Politécnica Salesiana, con herramientas especializadas como Kali Linux y Nessus. Mediante estas tecnologías, se evalúan aspectos críticos de la seguridad de un sistema: cuánto puede resistir ataques, qué tan efectivos son sus mecanismos de defensa y qué tan capaces son de identificar puntos débiles que podrían ser explotados. Se utiliza una metodología novedosa para examinar la seguridad, con tecnologías emergentes y técnicas innovadoras. Así, se identificaron vulnerabilidades en los cuatro dominios web estudiados. Estas fueron clasificadas según el protocolo de CVSS (Sistema Común de Puntuación de Vulnerabilidades: Common Vulnerability Scoring System), lo que permitió priorizar para abordar las más críticas. Además, se escanearon los puertos abiertos para identificar posibles puntos de acceso no autorizados. Igualmente, se realizó la simulación de un ataque de phishing mediante correo electrónico, clonando el sitio web de acceso de la Universidad Salesiana para evaluar la susceptibilidad de los usuarios ante esta amenaza. El análisis reveló vulnerabilidades críticas, incluyendo una versión obsoleta de PHP y posibles ejecuciones remotas de código (CVSS 9.8-10) en “virtual. ups. edu. ec”. También, se detectaron problemas en SSL/TLS, como el uso de cifrados débiles y versiones desactualizadas de TLS (CVSS hasta 7.5). Asimismo, se identificaron riesgos medios relacionados con la falta de HSTS y vulnerabilidades en PHP y jQuery, junto con configuraciones SSH débiles de menor impacto (CVSS 2.6-3.7). Estos resultados indican la necesidad de realizar actualizaciones y mejoras en seguridad.

Título traducido de la contribución	Un Análisis Integral de la Infraestructura de Ciberseguridad en Entornos Académicos
Idioma original	Inglés estadounidense
Páginas (desde-hasta)	11-23
Número de páginas	13
Publicación	Revista Ingeniería
Volumen	35
N.º	35
DOI	https://doi.org/10.15517/ri.v35i1.60075
Estado	Publicada - 14 oct. 2024

Palabras clave

Cybersecurity
Kali linux
Nessus
Phishing
Vulnerabilities

Areas de Conocimiento del CACES

8417A Telecomunicaciones

Acceder al documento

10.15517/ri.v35i1.60075

Otros archivos y enlaces

Other Link

Generación de Energía Eléctrica Mediante la Integración a Internet de las Cosas de Mini Generadores Conectados a las Tuberías de Agua Potable de una Casa (Mini Turbinas e IOT)
Santillan Carranza, H. J. (Investigador principal), Colcha Chacon, L. I. (Estudiante Investigador), Mejia Orellana, J. A. (Estudiante Investigador), Peregrina Wong Wong, M. A. (Investigador Externo), Alcivar Alvarado, K. J. (Estudiante Investigador), Alcivar Sanchez, A. S. (Estudiante Investigador), Bohorquez Reyes, L. E. (Estudiante Investigador), Chacon Garcia, P. M. (Estudiante Investigador), Feijoo Roman, C. M. (Estudiante Investigador), Larrea Onofre, A. A. (Estudiante Investigador), Martinez Cedeño, M. L. (Estudiante Investigador), Mendoza Bernal, C. E. (Estudiante Investigador), Mora Madrid, M. A. (Estudiante Investigador), Muñoz Herrera, W. I. (Estudiante Investigador), Nieto Zambrano, N. A. (Estudiante Investigador), Ochoa Ayala, J. D. (Estudiante Investigador), Ordoñez Guzman, J. A. (Estudiante Investigador), Pesantez Carcelen, J. P. (Estudiante Investigador), Quezada Funes, K. Y. (Estudiante Investigador), Quiñonez Santos, N. D. (Estudiante Investigador), Ramirez Carrera, R. S. (Estudiante Investigador), Ramos Mendez, A. F. (Estudiante Investigador), Sanchez Piza, P. J. (Estudiante Investigador) & Vargas Vinueza, A. E. (Estudiante Investigador)
4/08/21 → …
Proyecto: Investigación y Desarrollo

Citar esto

@article{e5a9e7d4ae3b4d6e95391228ea5437d3,

title = "A Comprehensive Analysis of Cybersecurity Infrastructure in Academic Environments",

abstract = "This paper addresses a comprehensive analysis of cybersecurity systems in academic environments taking as a case study the domains: “www. ups. edu. ec”, “cas. ups. edu. ec”, “virtual. ups. edu. ec” y “dspace. ups. edu. ec”, of the Salesian Polytechnic University, using specialized tools such as Kali Linux and Nessus. Through these technologies, critical aspects of the system{\textquoteright}s security are evaluated: its ability to resist attacks, how effective its defense mechanisms are, and its capacity to identify exploitable weak points. A novel methodology is applied to evaluate the security of the system, using emerging technologies and innovative techniques. During the research, several vulnerabilities were identified covering the four studied domains. These were classified using the CVSS (Common Vulnerability Scoring System) rating protocol, which allowed the most critical ones to be prioritized and addressed first. In addition, a scan of open ports was performed to recognize possible unauthorized access points. As part of the security testing, a simulation of an email phishing attack was carried out by cloning the Salesian University access website, in order to assess users{\textquoteright} susceptibility to this threat. Domain security analysis revealed critical vulnerabilities, including an outdated version of PHP and possible remote code execution (CVSS 9.8-10) in “virtual. ups. edu. ec”. SSL/TLS security issues were also detected, such as the use of weak ciphers and outdated versions of TLS (CVSS up to 7.5). In addition, medium risks related to lack of HSTS and vulnerabilities in PHP and jQuery were found, along with weaker SSH configurations of lesser impact (CVSS 2.6-3.7). These results show the need for security updates and improvements.",

keywords = "Cybersecurity, Kali linux, Nessus, Phishing, Vulnerabilities, Cybersecurity, Kali linux, Nessus, Phishing, Vulnerabilities",

author = "\{Santillan Carranza\}, \{Holger Jorge\} and \{Arevalo Satan\}, \{Julio Andres\} and \{Wong Wong\}, \{Peregrina Maria Amparo\}",

year = "2024",

month = oct,

day = "14",

doi = "10.15517/ri.v35i1.60075",

language = "English (US)",

volume = "35",

pages = "11--23",

journal = "Revista Ingenier{\'i}a",

issn = "2215-2652",

publisher = "Universidad de Costa Rica",

number = "35",

}

TY - JOUR

T1 - A Comprehensive Analysis of Cybersecurity Infrastructure in Academic Environments

AU - Santillan Carranza, Holger Jorge

AU - Arevalo Satan, Julio Andres

AU - Wong Wong, Peregrina Maria Amparo

PY - 2024/10/14

Y1 - 2024/10/14

N2 - This paper addresses a comprehensive analysis of cybersecurity systems in academic environments taking as a case study the domains: “www. ups. edu. ec”, “cas. ups. edu. ec”, “virtual. ups. edu. ec” y “dspace. ups. edu. ec”, of the Salesian Polytechnic University, using specialized tools such as Kali Linux and Nessus. Through these technologies, critical aspects of the system’s security are evaluated: its ability to resist attacks, how effective its defense mechanisms are, and its capacity to identify exploitable weak points. A novel methodology is applied to evaluate the security of the system, using emerging technologies and innovative techniques. During the research, several vulnerabilities were identified covering the four studied domains. These were classified using the CVSS (Common Vulnerability Scoring System) rating protocol, which allowed the most critical ones to be prioritized and addressed first. In addition, a scan of open ports was performed to recognize possible unauthorized access points. As part of the security testing, a simulation of an email phishing attack was carried out by cloning the Salesian University access website, in order to assess users’ susceptibility to this threat. Domain security analysis revealed critical vulnerabilities, including an outdated version of PHP and possible remote code execution (CVSS 9.8-10) in “virtual. ups. edu. ec”. SSL/TLS security issues were also detected, such as the use of weak ciphers and outdated versions of TLS (CVSS up to 7.5). In addition, medium risks related to lack of HSTS and vulnerabilities in PHP and jQuery were found, along with weaker SSH configurations of lesser impact (CVSS 2.6-3.7). These results show the need for security updates and improvements.

AB - This paper addresses a comprehensive analysis of cybersecurity systems in academic environments taking as a case study the domains: “www. ups. edu. ec”, “cas. ups. edu. ec”, “virtual. ups. edu. ec” y “dspace. ups. edu. ec”, of the Salesian Polytechnic University, using specialized tools such as Kali Linux and Nessus. Through these technologies, critical aspects of the system’s security are evaluated: its ability to resist attacks, how effective its defense mechanisms are, and its capacity to identify exploitable weak points. A novel methodology is applied to evaluate the security of the system, using emerging technologies and innovative techniques. During the research, several vulnerabilities were identified covering the four studied domains. These were classified using the CVSS (Common Vulnerability Scoring System) rating protocol, which allowed the most critical ones to be prioritized and addressed first. In addition, a scan of open ports was performed to recognize possible unauthorized access points. As part of the security testing, a simulation of an email phishing attack was carried out by cloning the Salesian University access website, in order to assess users’ susceptibility to this threat. Domain security analysis revealed critical vulnerabilities, including an outdated version of PHP and possible remote code execution (CVSS 9.8-10) in “virtual. ups. edu. ec”. SSL/TLS security issues were also detected, such as the use of weak ciphers and outdated versions of TLS (CVSS up to 7.5). In addition, medium risks related to lack of HSTS and vulnerabilities in PHP and jQuery were found, along with weaker SSH configurations of lesser impact (CVSS 2.6-3.7). These results show the need for security updates and improvements.

KW - Cybersecurity

KW - Kali linux

KW - Nessus

KW - Phishing

KW - Vulnerabilities

KW - Cybersecurity

KW - Kali linux

KW - Nessus

KW - Phishing

KW - Vulnerabilities

UR - https://revistas.ucr.ac.cr/index.php/ingenieria/article/view/60075

U2 - 10.15517/ri.v35i1.60075

DO - 10.15517/ri.v35i1.60075

M3 - Article

SN - 2215-2652

VL - 35

SP - 11

EP - 23

JO - Revista Ingeniería

JF - Revista Ingeniería

IS - 35

ER -

A Comprehensive Analysis of Cybersecurity Infrastructure in Academic Environments

Resumen

Palabras clave

Areas de Conocimiento del CACES

Acceder al documento

Otros archivos y enlaces

Huella

Proyectos

Generación de Energía Eléctrica Mediante la Integración a Internet de las Cosas de Mini Generadores Conectados a las Tuberías de Agua Potable de una Casa (Mini Turbinas e IOT)

Citar esto