Hackeo ético utilizando mejores prácticas mediante la metodología osstmm v3: caso de estudio. “Empresa Fonet Cia. Ltda.”

Abstract

In recent years it has been possible to show how technological advances have brought us great improvements in daily life, this leading to companies or institutions being kept in constant informatics updates. For this reason, in this project, information security has been taken as an important factor, thus generating an investigation of the risks and vulnerabilities that can be carried out within the infrastructure of a company, in order to avoid computer attacks by criminals called crackers or computer pirates. The company INTERNET BY FIBER OPTIC FONET CIA LTDA has the need to perform a scan of its vulnerabilities on its internal network, for this purpose the application of an ethical hack was proposed to detect said computer vulnerabilities and to be able to correct them to avoid future attacks that may prejudice its integrity as a private institution. he company provides Fiber Optic Internet services to hundreds of subscribers. If the company suffers computer attacks, the integrity of its subscribers may also be affected, since an ISP company has direct links with its clients, noting the seriousness that an attack can have. effect like this, is where the institution opens its doors to put this project into practice and in turn avoid this type of case and thus be able to preserve not only its integrity. This investigation consists of four chapters, where the first chapter presents the theoretical foundation that describes all aspects of computer security and the methodology to be used, it also has another type of foundation related to computer security. In the second chapter, the development of the prototype and its definition is carried out, as well as the application methodology that will be used for the development of the research, the selected methodology is the OSSTMM in its version 3, this methodology is one of the most complete for computer security audits, it has a risk assessment system designated RAVs, The OSSTMM methodology has four channels of which two were chosen, the wireless channel and the telecommunications channel, this methodology indicates that each channel must be verified, purchased and accounted for according to the objective that has been set.