Security Analysis of Campus Asset Information System with Penetration Testing Method using OWASP Framework at University XYZ

Recent technological advancements have increased the risk of cyber-attacks, particularly targeting web-based applications. According to the BSSN 2023 report, Indonesia recorded 189 web defacement incidents, primarily caused by vulnerabilities such as SQL injection, authentication flaws, and data leakage. One of the affected systems is the Campus Asset Information System (SIAK) at University XYZ, which has undergone several system updates without corresponding security testing, posing a significant risk. This study aimed to identify and analyze security vulnerabilities in the SIAK application using penetration testing based on the OWASP Top 10 2021 framework. The case study was conducted on the SIAK application, involving data collection, system security testing, and analysis of penetration testing results. The testing revealed four vulnerabilities, although most categories (e.g., Broken Access Control, Injection, and SSRF) did not exhibit vulnerabilities. The identified weaknesses included missing security headers (A05: Security Misconfiguration), the use of outdated components (A06: Vulnerable and Outdated Components), the absence of login rate limiting (A07: Identification and Authentication Failures), and insufficient monitoring of suspicious activity (A09: Security Logging and Monitoring Failures). These findings underscore the importance of regular security assessments, timely updates, and robust monitoring to enhance system resilience. Based on these findings, are used to provided recommendations to improve the system security posture and reduce the likelihood of future attacks.