Análisis de las malas prácticas en Active Directory mediante herramientas de Pentesting y mitigación de vulnerabilidades a través de un marco metodológico de seguridad.
Fecha
2021-09-27
Autores
Título de la revista
ISSN de la revista
Título del volumen
Editor
Universidad de Guayaquil. Facultad de Ingeniería Industrial. Carrera de Ingeniería en Teleinformática.
Resumen
Actualmente lasempresas han puesto en prácticael uso de los directorios activos como Active Directorypara la centralización de la informacióncon el fin de mantener un mayor control de la información. Sin embargo,existeuna cantidad considerable de antecedentes que reflejanincidentes de seguridad en losservicios de Active Directory. Por lo que es calificado como activo críticode la organización debido a que durantela fase de implementación y configuraciónse desarrolla con mala práctica, lo que genera una serie de vulnerabilidades que son explotadas por agentes externos. Frente a esto se sustenta el objetivo principal de este trabajo, el cual es proveer el conocimiento necesariode seguridad de la informaciónque sirva de guía para una correcta administraciónde los serviciosde Active Directory, en base al análisis de vulnerabilidades utilizando métodosde pentesting en un ambiente controlado que emule escenariosmáscomunes de malas prácticas, asímismo definir lineamientos para el desarrollo de políticasde seguridad de la informaciónque cumplan con los objetivos de la organización.
Currently, companies have implemented the use of active directories such as Active Directory for the centralization of information in order to maintain greater control of information. However, there is a considerable amount of precedents that reflect security incidents in Active Directory services. Therefore, it is qualified as a critical asset of the organization due to the fact that during the implementation and configuration phase it is developed with bad practices, which generates a series of vulnerabilities that are exploited by external agents. The main objective of this work is to provide the necessary information security knowledge to serve as a guide for a correct management of Active Directory services, based on the analysis of vulnerabilities using pentesting methods in a controlled environment that emulates the most common scenarios of bad practices, as well as to define guidelines for the development of information security policies that meet the objectives of the organization
Currently, companies have implemented the use of active directories such as Active Directory for the centralization of information in order to maintain greater control of information. However, there is a considerable amount of precedents that reflect security incidents in Active Directory services. Therefore, it is qualified as a critical asset of the organization due to the fact that during the implementation and configuration phase it is developed with bad practices, which generates a series of vulnerabilities that are exploited by external agents. The main objective of this work is to provide the necessary information security knowledge to serve as a guide for a correct management of Active Directory services, based on the analysis of vulnerabilities using pentesting methods in a controlled environment that emulates the most common scenarios of bad practices, as well as to define guidelines for the development of information security policies that meet the objectives of the organization
Descripción
Este documento contiene archivo en PDF.
Palabras clave
REDES INTELIGENTES, MALAS PRÁCTICAS, PENTESTING, MITIGACIÓN DE VULNERABILIDADES