The software development environment is focused on reaching functional products in the shortest period by making use of the least amount of resources possible. In this scenario, crucial elements such as software quality or software security are not considered at all, and in most cases, the high value offered to the projects is not taken into account. Nowadays, agile models are booming. They are defined by the way they achieve the interaction and integration of everyone involved in the software life cycle, the advantages of the quick reaction to change, and the implementation of artifacts or deliverables which display the level of progress reached at any time. In this context, it seems clearly necessary to define a new software development model, which prioritizes security aspects at any phase of the software life cycle and takes advantage of the benefits of the agile models. The proposed methodology shows that if security is considered from the beginning, vulnerabilities are easily detected and solved during the time planned for the project, with no extra time nor costs for the client and it increases the possibilities of reaching success in terms of not only functionality but also quality.

No abstract

No abstract

No abstract

Organizations use Active Directory Windows service to authenticate users in a network with the extended Kerberos Authentication protocol. Therefore, it is necessary to investigate its resistance to the different types of attacks it can suffer, the best way to detect them and to parameterize it to mitigate the effects of the attacks. This work analyzes the main Kerberos attacks in Active Directory Windows networks, inherent in the design of the protocol and not resolved. For each attack the objective is studied, implementation is developed in a virtual laboratory and detection is analyzed, proposing measures for mitigation and response. Subsequently, they are discussed in a general way and the results of the attacks are analyzed according to some parameters. As conclusions of the work carried out, it should be noted that although the attacks are mostly difficult to implement, their detection is even more complicated, and the damage is very severe so it's necessary to continuously monitor the logs in these environments to detect them and taking into account strict recommendations for mitigation and response.

This study presents a methodology to evaluate and prevent security vulnerabilities issues for web applications. The analysis process is based on the use of techniques and tools that allow to perform security assessments of white box and black box, to carry out the security validation of a web application in an agile and precise way. The objective of the methodology is to take advantage of the synergies of semi-automatic static and dynamic security analysis tools and manual checks. Each one of the phases contemplated in the methodology is supported by security analysis tools of different degrees of coverage, so that the results generated in one phase are used as feed for the following phases in order to get an optimized global security analysis result. The methodology can be used as part of other more general methodologies that do not cover how to use static and dynamic analysis tools in the implementation and testing phases of a Secure Software Development Life Cycle (SSDLC). A practical application of the methodology to analyze the security of a real web application demonstrates its effectiveness by obtaining a better optimized vulnerability detection result against the true and false positive metrics. Dynamic analysis with manual checking is used to audit the results, 24.6 per cent of security vulnerabilities reported by the static analysis has been checked and it allows to study which vulnerabilities can be directly exploited externally. This phase is very important because it permits that each reported vulnerability can be checked by a dynamic second tool to confirm whether a vulnerability is true or false positive and it allows to study which vulnerabilities can be directly exploited externally. Dynamic analysis finds six (6) additional critical vulnerabilities. Access control analysis finds other five (5) important vulnerabilities such as Insufficient Protected Passwords or Weak Password Policy and Excessive Authentication Attacks, two vulnerabilities that permit brute force attacks.

This paper provides a complete study on email requirements, with special emphasis on its security aspects and architecture. It explores how current protocols have evolved, the environment in which they have been developed and the evolution of security requirements. This paper also analyzes email vulnerabilities and the reasons that have motivated the exploitation of them. The threats and solutions of the most used email protocols today are detailed, such as Simple Mail Transfer Protocol, Post office Protocol, Internet Message Access Protocol protocols, among others. An analysis of the main security solutions proposed in recent years is carried out and how these threats are solved, as well as a comparison of each of them. The result of this work leads us to conclude that it is necessary to make an integral change in the protocols used in the electronic mail in order to have a secure message exchange system that meets all the security requirements demanded today. We are working on a proposal based on blockchain that solves the security problems identified in this work.

Blockchain is a new application technology in many sectors and the same is true in the world of education. Therefore, there is an increasingly emerging need to research blockchain technology, as it is still taking its first steps in different sectors, such as education. This article presents a review of the state of the art of blockchain technology in the education sector, focusing on identifying the advantages, disadvantages, and challenges associated with the introduction of blockchain technology in the education sector. In addition, the implementation of a title certificate solution through blockchain technology through the BeCertify project is presented. In this solution, the development stages of the platform, the system architecture, and the operation of the API have been carried out, resulting in a platform that constitutes the first step towards a more transparent and technologically advanced way of managing the certifications of the students' qualifications.