Análisis de herramientas open source para escaneo de vulnerabilidades en servidores de red local aplicando la norma iso 9126

Abstract

Currently there is evidence of the emergence of new technologies, which has led companies and organizations to automate their systems to obtain greater productivity, however, with the existence of new technologies, new threats also arise such as access to confidential user information, password theft, viruses, etc., which become a risk to the integrity and security of systems and servers, which become a risk to the integrity and security of systems and servers, therefore it is of utmost importance that the administrators of these servers implement tools capable of performing the process of scanning systems and detect vulnerabilities that impair their performance, in turn it is essential to know which tools are best suited to the systems and servers to obtain optimal results and with greater accuracy. According to experts, it is advisable to implement reliable tools that perform vulnerability scanning to the systems and servers of the organizations in order to detect possible vulnerabilities in time; it is also recommended to perform this type of process 1 to 2 times a year depending on the size of the company, i.e., companies that handle large volumes of information should apply this process periodically to prevent damage to their systems. One of the best ways to identify complete tools that provide accurate results is to perform an analysis of these tools by applying international quality standards that evaluate their operation, use, etc., such as the ISO 9126 software quality standard, which evaluates based on six main characteristics. Taking into account the above mentioned, the purpose of this work is to perform a comparative analysis of the external quality of three open-source tools specialized in vulnerability scanning in local network servers, taking as evaluation criteria the characteristics and sub characteristics of the ISO 9126 quality standard and thus identify the tool that provides the most reliable and accurate results. For the development of the respective analysis, a search was made in reliable bibliographic sources on the tools currently used by experts, to then apply them within a simulated environment, obtain results and achieve the comparative analysis, it is worth mentioning that in order to carry out this analysis, the characteristics of the ISO 9126 standard that best fit the type of software to be evaluated were selected and thus determine the tool that meets most of the established criteria. According to the results obtained, it can be said that both Nessus Essentials and OpenVAS, having a graphical interface, have a greater advantage over Nmap, since they are more attractive to the user, easy to use and easy to understand, on the other hand, in terms of efficiency it was concluded that the three tools analyzed are at the same level. When analyzing the results in a general way it can be said that the Nessus Essentials tool meets most of the selected criteria, therefore, it is concluded that, based on the three analyzed tools, Nessus Essentials is the most complete and suitable for performing vulnerability scanning processes.