Identificación de vulnerabilidades basados en programación: buenas prácticas de programación para sistemas informáticos más seguros

Programming-based vulnerability identification: best programming practices for more secure computer systems

En este documento se analizarán las diversas vulnerabilidades basados en programación. Se presentará un análisis exhaustivo de la investigación llevada a cabo, junto con ejemplos concretos que ilustran estas vulnerabilidades. Además, se proporcionarán recomendaciones prácticas para la prevención y mitigación de ataques maliciosos perpetrados por agentes adversos. El objetivo de este trabajo es concienciar a las empresas sobre la crítica importancia de implementar robustas medidas de ciberseguridad.  

1. M. Howard, D. LeBlanc y J. Viega, 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them. New York, NY, USA: McGraw-Hill, 2021.
2. Cybersecurity and Infrastructure Security Agency (CISA), “Securing Web Applications: Mitigating Common Vulnerabilities,” U.S. Department of Homeland Security, Washington, D.C., USA, Tech. Rep. 2023.
3. OWASP Foundation, “OWASP Top Ten 2021,” Open Worldwide Application Security Project, 2021. [Online]. Available: https://owasp.org/www-project-top-ten/
4. National Institute of Standards and Technology (NIST), NIST Special Publication 800-53: Security and Privacy Controls for Federal Information Systems and Organizations. Gaithersburg, MD, USA: NIST, 2020.
5. M. Christakis and C. Bird, “What Developers Want and Need from Program Analysis: An Empirical Study,” Proc. IEEE/ACM 41st Int. Conf. Softw. Eng., May 2021.
6. B. Schneier, Applied Cryptography: Protocols, Algorithms, and Source Code in C. Hoboken, NJ, USA: Wiley, 2021.
7. A. J. Menezes, P. C. van Oorschot, y S. A. Vanstone, Handbook of Applied Cryptography. Boca Raton, FL, USA: CRC Press, 2021.
8. S. Garfinkel y G. Spafford, Web Security, Privacy and Commerce. Sebastopol, CA, USA: O'Reilly Media, 2023.
9. Verizon, “2023 Data Breach Investigations Report,” Verizon Communications, 2023. [Online]. Available: https://www.verizon.com/dbir/
10. M. Bishop, Computer Security: Art and Science, 2nd ed. Boston, MA, USA: Addison-Wesley, 2019.
11. G. McGraw, Software Security: Building Security In. Boston, MA, USA: Addison-Wesley, 2021.
12. C. Bird et al., “DevSecOps: Integrating Security in Agile Development,” IEEE Security & Privacy, vol. 19, no. 3, pp. 45–53, May 2021.
13. S. J. Vaughan-Nichols, “DevSecOps: Building Security into CI/CD Pipelines,” IEEE Comput., vol. 53, no. 9, pp. 14–19, Sep. 2022.
14. J. Williams, “SQL Injection Attack Detection Techniques,” IEEE Trans. Inf. Forensics Secur., vol. 18, no. 5, pp. 423–432, 2023.
15. OWASP Foundation, "Cross-Site Scripting (XSS)," OWASP, 2021. [Enlace]. Available: https://owasp.org/www-community/attacks/xss.
16. OWASP Foundation, "Cross-Site Request Forgery (CSRF)," OWASP, 2021. [Enlace]. Available: https://owasp.org/www-community/attacks/csrf.
17. A. K. Ghosh, “Mitigating Buffer Overflow Vulnerabilities,” IEEE Softw., vol. 38, no. 6, pp. 60–66, Nov. 2021.
18. S. Murtaza, "Buffer overflow attacks," GeeksforGeeks, 2020. [Enlace]. Available: https://www.geeksforgeeks.org/buffer-overflow-attack/.
19. OWASP Foundation, "Using components with known vulnerabilities," OWASP, 2021. [Enlace]. Available: https://owasp.org/www-community/Vulnerabilities/Using_Components_with_Known_Vulnerabilities.
20. F. Wu, “Security Concerns in JWT Implementations,” IEEE Comput., vol. 55, no. 1, pp. 28–35, Jan. 2023.
21. Kinsta. "Ataque CSRF: qué es, cómo funciona y cómo prevenirlo." Kinsta Blog, https://kinsta.com/es/blog/ataque-csrf/. Consultado el 12 de octubre de 2024.
22. J. Viega & G. McGraw, Building Secure Software: How to Avoid Security Problems the Right Way. Addison-Wesley. 2001.
23. OWASP Foundation, “OWASP Zed Attack Proxy (ZAP),” [Online]. Available: https://owasp.org/www-project-zap/
24. M. Howard & D. LeBlanc, Writing Secure Code (2nd ed.). Microsoft Press. 2003.
25. R. Sandhu, E. J. Coyne, H. L. Feinstein & C. E. Youman, Role-Based Access Control Models. IEEE Computer, 29(2), 38–47. https://doi.org/10.1109/2.485845 1996.
26. B. Chess & J. West, Secure Programming with Static Analysis. Addison-Wesley. 2007.
27. PortSwigger Ltd., “Burp Suite Professional,” 2023. [Online]. Available: https://portswigger.net/burp
28. Tenable, Inc., “Nessus Vulnerability Scanner,” 2023. [Online]. Available: https://www.tenable.com/products/nessus
29. SonarSource S.A., “SonarQube Documentation,” 2023. [Online]. Available: https://www.sonarsource.com/products/sonarqube/
30. CIRT.net, “Nikto Web Scanner,” 2023. [Online]. Available: https://cirt.net/Nikto2
31. Snyk Ltd., “Snyk Open Source Security,” 2023. [Online]. Available: https://snyk.io/
32. ISO/IEC, ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection – Information security management systems – Requirements, International Organization for Standardization, Geneva, 2022.
33. PCI Security Standards Council, Payment Card Industry Data Security Standard – Requirements and Security Assessment Procedures, Version 4.0, Mar. 2022. [Online]. Available: https://www.pcisecuritystandards.org/
34. European Union, General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, Official Journal of the European Union, Apr. 2016.
35. ISACA, COBIT 2019 Framework: Governance and Management Objectives, ISACA, Schaumburg, IL, USA, 2019.