Peningkatan Keamanan Sistem Informasi Menggunakan Standar OWASP ASVS dengan Vulnerability Assessment dan Remediasi

Azmi, Zain Maulana (2026) Peningkatan Keamanan Sistem Informasi Menggunakan Standar OWASP ASVS dengan Vulnerability Assessment dan Remediasi. Masters thesis, Institut Teknologi Sepuluh Nopember.

Text 6025241031-Master_Thesis.pdf - Accepted Version Restricted to Repository staff only Download (5MB) | Request a copy

Abstract

Peningkatan keamanan aplikasi web memerlukan pendekatan yang sistematis dan terukur agar efektivitas kontrol keamanan dapat dinilai dengan jelas. Pada kondisi eksisting, pengukuran keamanan aplikasi web belum memiliki mekanisme evaluasi yang menghubungkan temuan vulnerability assessment dengan kontrol keamanan terstandar, sehingga tidak tersedia dasar kuantitatif untuk menilai tingkat keamanannya. Penelitian ini bertujuan meningkatkan keamanan aplikasi berbasis web melalui penerapan OWASP Application Security Verification Standard (ASVS) Level 2 yang dikombinasikan dengan vulnerability assessment otomatis menggunakan OWASP Zed Attack Proxy (ZAP). Temuan ZAP yang meliputi tingkat keparahan dan Common Weakness Enumeration (CWE) dipetakan ke kontrol ASVS untuk menentukan tingkat pemenuhan awal. Setiap requirement diberi skor 0, 0,5, atau 1 dan diolah menggunakan Security Strength Evaluation Model (SSEM) untuk memperoleh nilai keamanan yang disebut Security Strength System of Interest (S(SOI)) pada kondisi eksisting. Remediasi kemudian dilaksanakan berdasarkan kontrol ASVS Level 2 yang belum terpenuhi, diikuti dengan pengujian ulang menggunakan ZAP serta pemutakhiran pemenuhan kontrol ASVS. Hasil penelitian menunjukkan bahwa jumlah temuan vulnerability assessment dari semua aplikasi uji menurun dari 96 temuan menjadi 33 temuan, atau berkurang sebesar 65,6%. Selain itu, seluruh temuan dengan severity High dan Medium berhasil diturunkan menjadi 0 setelah remediasi. Nilai rata-rata S(SOI) meningkat dari 5,97 menjadi 8,96, dengan rata-rata kenaikan sebesar 2,99 poin atau sekitar 50,1%. Hasil tersebut menunjukkan bahwa integrasi OWASP ZAP, pemetaan CWE–ASVS, dan SSEM dapat digunakan sebagai evaluasi keamanan yang kuantitatif serta workflow penerapan standar untuk meningkatkan keamanan aplikasi web secara terukur.
=====================================================================================================================================
Improving web application security requires a systematic and measurable approach to clearly evaluate the effectiveness of security controls. Under the existing conditions, web application security assessments lack an evaluation mechanism that links vulnerability assessment findings to standardized security controls, resulting in the absence of a quantitative basis for determining security levels. This study aims to improve the security of web-based applications through the implementation of the OWASP Application Security Verification Standard (ASVS) Level 2 combined with automated vulnerability assessment using the OWASP Zed Attack Proxy (ZAP). ZAP findings, including severity levels and Common Weakness Enumeration (CWE) classifications, were mapped to ASVS controls to determine the initial level of compliance. Each requirement was assigned a score of 0, 0.5, or 1 and processed using the Security Strength Evaluation Model (SSEM) to obtain a security metric referred to as the Security Strength System of Interest (S(SOI)) under existing conditions. Remediation activities were then carried out based on unmet ASVS Level 2 controls, followed by retesting using ZAP and updating the ASVS compliance status. The results showed that the total number of vulnerability assessment findings across all test applications decreased from 96 findings to 33 findings, representing a reduction of 65.6%. In addition, all findings with High and Medium severity levels were successfully reduced to zero after remediation. The average S(SOI) score increased from 5.97 to 8.96, with an average improvement of 2.99 points or approximately 50.1%. These results indicate that the integration of OWASP ZAP, CWE–ASVS mapping, and SSEM can serve as a quantitative security evaluation method as well as a standardized implementation workflow for improving web application security in a measurable manner.

Item Type:	Thesis (Masters)
Uncontrolled Keywords:	Keamanan Aplikasi Web; OWASP ASVS; OWASP ZAP; Pemetaan CWE; Security Strength Evaluation Model; Vulnerability Assessment; CWE Mapping; OWASP ASVS; OWASP ZAP; Security Strength Evaluation Model; Vulnerability Assessment; Web Application Security;
Subjects:	T Technology > T Technology (General) > T58.5 Information technology. IT--Auditing
Divisions:	Faculty of Intelligent Electrical and Informatics Technology (ELECTICS) > Informatics Engineering > 55101-(S2) Master Thesis
Depositing User:	Zain Maulana Azmi
Date Deposited:	01 Aug 2026 03:17
Last Modified:	01 Aug 2026 03:17
URI:	http://repository.its.ac.id/id/eprint/141266

Actions (login required)

View Item