CYBERSECURITY IN THE APPLICATIONAL CONTEXT. KEYCLOAK, KONG AND CODE VERIFIER

• Autor(a) principal: Sousa, André Jorge Martins
• Data de Publicação: 2023
• Tipo de documento: Dissertação
• Idioma: eng
• Título da fonte: Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
• Texto Completo: http://hdl.handle.net/10362/164323
• topic: cybercrime; cybersecurity; vulnerabilities; architecture; plugin; Domínio/Área Científica::Engenharia e Tecnologia::Engenharia Eletrotécnica, Eletrónica e Informática

Cybercrime has increased over the past few years, as has the number of victims and the amount of data lost and stolen. This escalation in cybercrime has led to greater concern about cybersecurity, which has resulted in the creation of norms, rules and standards to guide and protect users in cyberspace. This special concern for cybersecurity has also reached Link Consulting, which, as an IT company, endeavours to guarantee the security of its products. Link Consulting, responsible forsuggesting the topic of this dissertation, is a technology company that seeks to offer its customers IT solutions that not only fulfil their requirements, but also guarantee reliability and trust. The Egov department is one of the various departments in the company that will be the subject of this dissertation. The most significant difference between Egov and the other departments is that it focuses on work in the public sector only. The department currently has a reference architecture to guide programmers in their work. With this increase in concern for Link, there was an interest in reinforcing and guaranteeing the security of the architecture. It is possible to identify some tools and possible vulnerabilities. These possible points of failure were studied, identifying the causes of the problem and possible solutions. To help Link mitigate the existing vulnerabilities in its architecture, a mechanism was created to automate the verification of these points of failure, complementing the current mechanisms with another tool that could be beneficial to the company. After analysing the entire architecture and mitigating the possible existing vulnerabilities, it was then possible to obtain a plugin that can not only identify the vulnerabilities present in Keycloak, but also check for them and report them to users. The result allows users to visualize in Jenkins (or in an output file) the result of the checks made on Keycloak, showing the vulnerabilities found and the proposed solution to them. Since Keycloak is widely known and used, in order to allow users to have greater confidence in it, and considering the results obtained to be of public use, it is intended to publish the results as open-source, so that they can be implemented by other users and thus minimize the chance of vulnerabilities in their Keycloak instances as well. Therefore, the vulnerabilities present in the reference architecture are considered to be mitigated, and it has been possible to take another step towards guaranteeing its security.