Descoberta e mitigação de vulnerabilidades em auditoria de segurança

Abstract

This work describes the process of identifying and mitigating vulnerabilities during a security audit, with an emphasis on web applications, performed during the student's professional activities. It discusses aspects of vulnerability exploitation, such as the incidence of attacks at both national and international levels, as well as fundamental information security concepts, inclu- ding Confidentiality, Integrity, and Availability (CIA). The study also addresses security testing methodologies, including static and dynamic tests, particularly Static Application Security Tes- ting (SAST), Vulnerability Assessment (VA), and Dynamic Application Security Testing (DAST). Additionally, the work covers the definition and impacts of ransomware attacks, highlighting how vulnerability mitigation can significantly reduce the risk of such incidents. Throughout the development of the activities, the challenges faced in an environment with limited familiarity with audit practices are presented, along with the strategies adopted to overcome them, this resulted in the approval of the security audit process, with a remediation rate of 99% for vulnerabilities identified during SAST/DAST testing and 91% for vulnerabilities identified in the VA during the audit. Based on the identified vulnerabilities and the mitigation results achieved, it is possible to demonstrate how vulnerability discovery and mitigation are feasible and essential processes, especially considering the risks posed by attack scenarios targeting institutions in recent years.