Seguridad en redes distribuidas de computadoras en entornos empresariales usando ethical hacking

Abstract

Security in distributed computer networks is a transversal discipline, often with problems in various stages such as development, design, maintenance and implementation of the aforementioned technologies. The goal of security is to protect the resources in the systems of an organization or company. In addition, the only people who can have access to the information are those authorized to do so. Companies are required to implement security measures to protect the privacy and confidentiality of the information they hold and process. One of the most common activities used by companies is pentesting or penetration testing of their network. These penetration tests involve exposing one or more computers on a network to a computer attack, and detecting vulnerabilities to develop measures to prevent these external attacks. It is important to look at the environment in which the company operates, such as the tools it uses or the way its employees work, since the human factor is one of the main reasons malwares infiltrates the system. Many vulnerabilities can generally be found in an organization's critical resources, while performing penetration testing requires experience and knowledge, it is not just for large organizations with a set of servers providing different services and network segments covering large amounts of data. of computer equipment, these tests can be performed on an independent computer and even on a personal computer; Of course, they won't be as accurate as professional ones, but they're still good enough, for whats's required. The most obvious vulnerabilities can be found by making it easy to implement security controls and precautions to prevent intrusion and unwanted behavior of the product or service under test. Because of this, a corporate network was implemented in a virtualized and controlled way, and to test various aspects of its security and present the problems that generally exist in real life against attacks that commonly come from cyber attackers or hackers. Once the environment was ready to be used, the development of the network penetration tests continued from the Parrot Security operating system, which is accompanied by its suite of tools for auditing and pentesting of various types of environments, and with the help of an investigation on attacks most used by attackers or pentesters will be, perfected to carry out a correct execution of the tests, taking into account their foundation and form of application according to the need for use in the face of an attack or pentesting. The Penetration Test Execution Standard. PTES, is made up of seven phases, which start from some preliminary questions that defined the scope of the testing work until the preparation of a report, in addition, a final phase was added that costs corrections or measures of security towards the vulnerabilities that were found during the development of the tests. The evaluation plan was created with the purpose of being able to visualize the results of the penetration tests to the business environment with default configurations and that the attackers use to exploit the vulnerabilities they find and obtain what they are looking for and on the other hand the results are visualized that are obtained after applying the corrections or configurations that could be made to be protected against an eventual attack by a cybercriminal and that the large communities of professionals in the area of computer security recommend. Thanks to these results, it was possible to determine the conclusions and recommendations of the work, which will be very helpful for future research on issues related to the field of computer security in business networks using ethical hacking.