<?xml version="1.0" encoding="ISO-8859-1"?><article xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<front>
<journal-meta>
<journal-id>2227-1899</journal-id>
<journal-title><![CDATA[Revista Cubana de Ciencias Informáticas]]></journal-title>
<abbrev-journal-title><![CDATA[Rev cuba cienc informat]]></abbrev-journal-title>
<issn>2227-1899</issn>
<publisher>
<publisher-name><![CDATA[Editorial Ediciones Futuro]]></publisher-name>
</publisher>
</journal-meta>
<article-meta>
<article-id>S2227-18992021000500333</article-id>
<title-group>
<article-title xml:lang="es"><![CDATA[Procedimiento para evaluar seguridad a productos de software]]></article-title>
<article-title xml:lang="en"><![CDATA[Procedure for evaluating security of software products]]></article-title>
</title-group>
<contrib-group>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Menejías García]]></surname>
<given-names><![CDATA[Roberto]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Hidalgo Reyes]]></surname>
<given-names><![CDATA[Noel Harrinso]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Marín Díaz]]></surname>
<given-names><![CDATA[Aymara]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Trujillo Casañola]]></surname>
<given-names><![CDATA[Yaimí]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
</contrib-group>
<aff id="Af1">
<institution><![CDATA[,Universidad de las Ciencias Informáticas  ]]></institution>
<addr-line><![CDATA[ ]]></addr-line>
<country>Cuba</country>
</aff>
<pub-date pub-type="pub">
<day>00</day>
<month>00</month>
<year>2021</year>
</pub-date>
<pub-date pub-type="epub">
<day>00</day>
<month>00</month>
<year>2021</year>
</pub-date>
<volume>15</volume>
<numero>4</numero>
<fpage>333</fpage>
<lpage>349</lpage>
<copyright-statement/>
<copyright-year/>
<self-uri xlink:href="http://scielo.sld.cu/scielo.php?script=sci_arttext&amp;pid=S2227-18992021000500333&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://scielo.sld.cu/scielo.php?script=sci_abstract&amp;pid=S2227-18992021000500333&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://scielo.sld.cu/scielo.php?script=sci_pdf&amp;pid=S2227-18992021000500333&amp;lng=en&amp;nrm=iso"></self-uri><abstract abstract-type="short" xml:lang="es"><p><![CDATA[RESUMEN En la industria del software, la realización de pruebas de calidad constituye la principal forma para la detección de errores y vulnerabilidades, sin embargo, muchas investigaciones y tendencias evidencian que se realizan luego de finalizado el producto y muchas veces solo se ejecutan pruebas funcionales. Esto supone un problema ya que en muchas ocasiones en los resultados de la realización de las pruebas se detectan problemas de tipo: vulnerabilidad, fallos en la integridad de los datos, disponibilidad, pérdidas y costo mediante la manipulación y robo de información. Para garantizar un mayor nivel de seguridad en los sistemas, se realizan las pruebas de seguridad para evaluar específicamente estos elementos fundamentales. En el presente artículo se describe un procedimiento para realizar pruebas no funcionales para evaluar la característica de calidad del producto de seguridad. Es independiente del negocio, del tipo de producto y de la metodología de desarrollo de software. El procedimiento tiene en cuenta buenas prácticas documentas en modelos, normas y estándares reconocidos internacionalmente, que a su vez fueron enriquecidas y particularizadas por expertos de organizaciones cubanas. Se describe el qué probar y el cómo hacerlo, y se muestran los resultados de la valoración de la propuesta por expertos.]]></p></abstract>
<abstract abstract-type="short" xml:lang="en"><p><![CDATA[ABSTRACT In the software industry, the performance of quality tests is the main way to detect errors and vulnerabilities, however many investigations and trends show that they are carried out after the product is finished and many times only functional tests are executed. This is a problem since in many cases, in the results of the tests, problems of type are detected: vulnerability, failures in the integrity of the data, availability, losses and cost through the manipulation and theft of information. To ensure a higher level of security in systems, security tests are performed to specifically evaluate these critical elements. This article describes a procedure for performing non-functional tests to evaluate the quality characteristic of the security product. It is independent of the business, the type of product and the software development methodology. The procedure takes into account good documented practices in internationally recognized models, norms and standards, which in turn were enriched and individualized by experts from Cuban organizations. What to try and how to do it is described, and the results of the evaluation of the proposal by experts are shown.]]></p></abstract>
<kwd-group>
<kwd lng="es"><![CDATA[pruebas]]></kwd>
<kwd lng="es"><![CDATA[vulnerabilidad]]></kwd>
<kwd lng="es"><![CDATA[seguridad]]></kwd>
<kwd lng="es"><![CDATA[procedimiento]]></kwd>
<kwd lng="en"><![CDATA[testing]]></kwd>
<kwd lng="en"><![CDATA[vulnerability]]></kwd>
<kwd lng="en"><![CDATA[security]]></kwd>
<kwd lng="en"><![CDATA[procedure]]></kwd>
</kwd-group>
</article-meta>
</front><back>
<ref-list>
<ref id="B1">
<nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Proaño Escalante]]></surname>
<given-names><![CDATA[Rodrigo Arturo]]></given-names>
</name>
<name>
<surname><![CDATA[Saguay Chafla]]></surname>
<given-names><![CDATA[Ciro Napoleón]]></given-names>
</name>
<name>
<surname><![CDATA[Jácome Canchig]]></surname>
<given-names><![CDATA[Segundo Bolívar]]></given-names>
</name>
<name>
<surname><![CDATA[Sandoval Zambrano]]></surname>
<given-names><![CDATA[Fanny]]></given-names>
</name>
</person-group>
<source><![CDATA[Sistemas basados en conocimiento como herramienta de ayuda en la auditoría de sistemas de información]]></source>
<year>2017</year>
</nlm-citation>
</ref>
<ref id="B2">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Marin Diaz]]></surname>
<given-names><![CDATA[Aymara]]></given-names>
</name>
<name>
<surname><![CDATA[Trujillo Casañola]]></surname>
<given-names><![CDATA[Yaimí]]></given-names>
</name>
<name>
<surname><![CDATA[Buedo Hidalgo]]></surname>
<given-names><![CDATA[Denys]]></given-names>
</name>
</person-group>
<source><![CDATA[Estrategia de pruebas para organizaciones desarrolladoras de software]]></source>
<year>2020</year>
<publisher-name><![CDATA[RNPS]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B3">
<nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Marin Diaz]]></surname>
<given-names><![CDATA[Aymara]]></given-names>
</name>
</person-group>
<source><![CDATA[Marco de trabajo con un enfoque por componentes para gestionar actividades de calidad.]]></source>
<year>2018</year>
<publisher-loc><![CDATA[La Habana ]]></publisher-loc>
</nlm-citation>
</ref>
<ref id="B4">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Yepes Guevara]]></surname>
<given-names><![CDATA[Ricardo]]></given-names>
</name>
</person-group>
<source><![CDATA[Un lenguaje para especificar pruebas de seguridad de caja negra automatizadas para sistemas Web.]]></source>
<year>2017</year>
<publisher-loc><![CDATA[Medellín, Colombia ]]></publisher-loc>
<publisher-name><![CDATA[Universidad de Antioquia, Facultad de Ingeniería,]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B5">
<nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Mera Paz]]></surname>
<given-names><![CDATA[Julián Andrés]]></given-names>
</name>
</person-group>
<source><![CDATA[Análisis del proceso de pruebas de calidad de software]]></source>
<year>2016</year>
</nlm-citation>
</ref>
<ref id="B6">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Rojas-Montes,]]></surname>
<given-names><![CDATA[Martha Lucía]]></given-names>
</name>
<name>
<surname><![CDATA[Pino-Correa]]></surname>
<given-names><![CDATA[Francisco José]]></given-names>
</name>
<name>
<surname><![CDATA[Martínez, James]]></surname>
<given-names><![CDATA[Mauricio]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Proceso de pruebas para pequeñas organizaciones desarrolladoras de software.]]></article-title>
<source><![CDATA[Revista Facultad de Ingeniería (Fac. Ing.),]]></source>
<year>2015</year>
<volume>24</volume>
<numero>39</numero>
<issue>39</issue>
</nlm-citation>
</ref>
<ref id="B7">
<nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Casas]]></surname>
<given-names><![CDATA[Valentina Hernández]]></given-names>
</name>
</person-group>
<source><![CDATA[Dashboard con indicadores para la gestión de riesgos de seguridad de la información de una empresa en Medellin]]></source>
<year>2020</year>
</nlm-citation>
</ref>
<ref id="B8">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Agarwal]]></surname>
<given-names><![CDATA[n]]></given-names>
</name>
</person-group>
<source><![CDATA[Hussain a closer look on Intrusion Detection System for web applications.]]></source>
<year>2018</year>
<publisher-name><![CDATA[arXiv preprint arXiv:1803.06153]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B9">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Amit]]></surname>
<given-names><![CDATA[i]]></given-names>
</name>
</person-group>
<source><![CDATA[Ptes: Penetration Testing Execution Standard]]></source>
<year>2012</year>
<publisher-name><![CDATA[The Penetration Testing Execution Standard]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B10">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Antunes]]></surname>
<given-names><![CDATA[n]]></given-names>
</name>
<name>
<surname><![CDATA[Vieira]]></surname>
<given-names><![CDATA[m]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Assessing and Comparing Vulnerability Detection Tools for Web Services: Benchmarking Approach and Examples]]></article-title>
<source><![CDATA[IEEE Transactions on Services Computing]]></source>
<year>2015</year>
<volume>8</volume>
<numero>2</numero>
<issue>2</issue>
<page-range>269-83</page-range></nlm-citation>
</ref>
<ref id="B11">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Bajovic]]></surname>
<given-names><![CDATA[v]]></given-names>
</name>
</person-group>
<source><![CDATA[Criminal Proceedings in Cyberspace: The Challenge of Digital Era.]]></source>
<year>2017</year>
<page-range>87-101</page-range><publisher-name><![CDATA[Springer International Publishing]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B12">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Ba&#351; seyyar]]></surname>
<given-names><![CDATA[m]]></given-names>
</name>
<name>
<surname><![CDATA[Çatak]]></surname>
<given-names><![CDATA[f. Ö.]]></given-names>
</name>
<name>
<surname><![CDATA[Gül]]></surname>
<given-names><![CDATA[e]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Detection of attack-targeted scans from the Apache HTTP Server access logs]]></article-title>
<source><![CDATA[Applied Computing and Informatics]]></source>
<year>2018</year>
<volume>14</volume>
<numero>1</numero>
<issue>1</issue>
<page-range>28-36</page-range></nlm-citation>
</ref>
<ref id="B13">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Bhandari]]></surname>
<given-names><![CDATA[s]]></given-names>
</name>
<name>
<surname><![CDATA[Jaballah]]></surname>
<given-names><![CDATA[w. B]]></given-names>
</name>
<name>
<surname><![CDATA[Jain]]></surname>
<given-names><![CDATA[v]]></given-names>
</name>
<name>
<surname><![CDATA[Laxmi]]></surname>
<given-names><![CDATA[v]]></given-names>
</name>
</person-group>
<source><![CDATA[Android inter-app communication threats and detection techniques]]></source>
<year>2017</year>
<volume>70</volume>
<page-range>392-421</page-range><publisher-name><![CDATA[Computers &amp; Security]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B14">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Calzavara]]></surname>
<given-names><![CDATA[s]]></given-names>
</name>
<name>
<surname><![CDATA[Focardi]]></surname>
<given-names><![CDATA[r]]></given-names>
</name>
<name>
<surname><![CDATA[Squarcina]]></surname>
<given-names><![CDATA[m]]></given-names>
</name>
<name>
<surname><![CDATA[Tempesta]]></surname>
<given-names><![CDATA[m]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Surviving the Web: A Journey into Web Session Security.]]></article-title>
<source><![CDATA[ACM Computing Surveys]]></source>
<year>2017</year>
<volume>50</volume>
<numero>1</numero>
<issue>1</issue>
</nlm-citation>
</ref>
<ref id="B15">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Dadkhah]]></surname>
<given-names><![CDATA[m]]></given-names>
</name>
<name>
<surname><![CDATA[Lagzian]]></surname>
<given-names><![CDATA[m]]></given-names>
</name>
<name>
<surname><![CDATA[Borchardt]]></surname>
<given-names><![CDATA[g]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Academic Information Security Researchers: Hackers or Specialists?]]></article-title>
<source><![CDATA[Science and Engineering Ethics]]></source>
<year>2018</year>
<volume>24</volume>
<numero>2</numero>
<issue>2</issue>
<page-range>785-90</page-range></nlm-citation>
</ref>
<ref id="B16">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Dalalana bertoglio]]></surname>
<given-names><![CDATA[d]]></given-names>
</name>
<name>
<surname><![CDATA[Zorzo]]></surname>
<given-names><![CDATA[a. F]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Overview and open issues on penetration test]]></article-title>
<source><![CDATA[Journal of the Brazilian Computer Society]]></source>
<year>2017</year>
<volume>23</volume>
<numero>1</numero>
<issue>1</issue>
</nlm-citation>
</ref>
<ref id="B17">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Dong]]></surname>
<given-names><![CDATA[y]]></given-names>
</name>
<name>
<surname><![CDATA[Zhang]]></surname>
<given-names><![CDATA[y]]></given-names>
</name>
<name>
<surname><![CDATA[Ma]]></surname>
<given-names><![CDATA[h]]></given-names>
</name>
<name>
<surname><![CDATA[Wu]]></surname>
<given-names><![CDATA[q]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[An adaptive system for detecting malicious queries in web attacks.]]></article-title>
<source><![CDATA[Science China Information Sciences,]]></source>
<year>2018</year>
<volume>61</volume>
<numero>3</numero>
<issue>3</issue>
<page-range>032-114</page-range></nlm-citation>
</ref>
<ref id="B18">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Franklin]]></surname>
<given-names><![CDATA[j]]></given-names>
</name>
<name>
<surname><![CDATA[Wergin]]></surname>
<given-names><![CDATA[c]]></given-names>
</name>
<name>
<surname><![CDATA[Booth]]></surname>
<given-names><![CDATA[h]]></given-names>
</name>
</person-group>
<source><![CDATA[cvss implementation guidance.]]></source>
<year>2014</year>
<publisher-name><![CDATA[National Institute of Standards and Technology]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B19">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Huang]]></surname>
<given-names><![CDATA[h. C]]></given-names>
</name>
<name>
<surname><![CDATA[Zhang]]></surname>
<given-names><![CDATA[z. K]]></given-names>
</name>
<name>
<surname><![CDATA[Cheng]]></surname>
<given-names><![CDATA[h. W]]></given-names>
</name>
<name>
<surname><![CDATA[Shieh]]></surname>
<given-names><![CDATA[s. W]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Web Application Security: Threats, Countermeasures, and Pitfalls]]></article-title>
<source><![CDATA[Computer]]></source>
<year>2017</year>
<volume>50</volume>
<numero>6</numero>
<issue>6</issue>
<page-range>81-5</page-range></nlm-citation>
</ref>
<ref id="B20">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Jhaveri]]></surname>
<given-names><![CDATA[m. H]]></given-names>
</name>
<name>
<surname><![CDATA[Cetin]]></surname>
<given-names><![CDATA[o]]></given-names>
</name>
<name>
<surname><![CDATA[Ga]]></surname>
<given-names><![CDATA[c]]></given-names>
</name>
<name>
<surname><![CDATA[Moore]]></surname>
<given-names><![CDATA[t]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Abuse Reporting and the Fight Against Cybercrime.]]></article-title>
<source><![CDATA[ACM Computer Surveys]]></source>
<year>2017</year>
<volume>49</volume>
<numero>4</numero>
<issue>4</issue>
<page-range>1-27</page-range></nlm-citation>
</ref>
<ref id="B21">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Knowles]]></surname>
<given-names><![CDATA[w]]></given-names>
</name>
<name>
<surname><![CDATA[Baron]]></surname>
<given-names><![CDATA[a]]></given-names>
</name>
<name>
<surname><![CDATA[Mcgarr]]></surname>
<given-names><![CDATA[t]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[the simulated security assessment ecosystem: Does penetration testing need standardisation?]]></article-title>
<source><![CDATA[Computers &amp; Security]]></source>
<year>2016</year>
<volume>62</volume>
<page-range>296-316</page-range></nlm-citation>
</ref>
<ref id="B22">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Mansfield-devine]]></surname>
<given-names><![CDATA[s]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Open-source software: determining the real risk posed by vulnerabilities.]]></article-title>
<source><![CDATA[Network Security]]></source>
<year>2017</year>
<volume>2017</volume>
<numero>1</numero>
<issue>1</issue>
<page-range>7-12</page-range></nlm-citation>
</ref>
<ref id="B23">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Martínez]]></surname>
<given-names><![CDATA[s]]></given-names>
</name>
<name>
<surname><![CDATA[Cosentino]]></surname>
<given-names><![CDATA[v]]></given-names>
</name>
<name>
<surname><![CDATA[Cabot]]></surname>
<given-names><![CDATA[j]]></given-names>
</name>
</person-group>
<source><![CDATA[Model-based analysis of Java EE web security misconfigurations]]></source>
<year>2017</year>
<volume>49</volume>
<page-range>36-61</page-range><publisher-name><![CDATA[Computer Languages, Systems &amp; Structures]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B24">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Meucci]]></surname>
<given-names><![CDATA[m]]></given-names>
</name>
<name>
<surname><![CDATA[Muller]]></surname>
<given-names><![CDATA[a]]></given-names>
</name>
</person-group>
<source><![CDATA[owasp Testing Guide 4.0]]></source>
<year>2014</year>
<page-range>224</page-range><publisher-loc><![CDATA[EE.UU ]]></publisher-loc>
<publisher-name><![CDATA[OWASP Foundation]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B25">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Montesino perurena]]></surname>
<given-names><![CDATA[r]]></given-names>
</name>
<name>
<surname><![CDATA[Baluja garcía]]></surname>
<given-names><![CDATA[w]]></given-names>
</name>
<name>
<surname><![CDATA[Porvén rubier]]></surname>
<given-names><![CDATA[j]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Gestión automatizada e integrada de controles de seguridad informática.]]></article-title>
<source><![CDATA[Ingeniería Electrónica, Automática y Comunicaciones]]></source>
<year>2013</year>
<volume>34</volume>
<numero>1</numero>
<issue>1</issue>
<page-range>40-58</page-range></nlm-citation>
</ref>
<ref id="B26">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Morrison]]></surname>
<given-names><![CDATA[p]]></given-names>
</name>
<name>
<surname><![CDATA[Smith]]></surname>
<given-names><![CDATA[b. H]]></given-names>
</name>
<name>
<surname><![CDATA[Williams]]></surname>
<given-names><![CDATA[l]]></given-names>
</name>
</person-group>
<source><![CDATA[Surveying Security Practice Adherence in Software Development.]]></source>
<year>2017</year>
<page-range>-85-94</page-range><publisher-name><![CDATA[Proceedings of the Proceedings of the Hot Topics in Science of Security: Symposium and Bootcamp, Hanover, MD]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B27">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Nazir]]></surname>
<given-names><![CDATA[s]]></given-names>
</name>
<name>
<surname><![CDATA[Patel]]></surname>
<given-names><![CDATA[s]]></given-names>
</name>
<name>
<surname><![CDATA[Patel]]></surname>
<given-names><![CDATA[d]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Assessing and augmenting SCADA cyber security: A survey of techniques]]></article-title>
<source><![CDATA[Computers &amp; Security]]></source>
<year>2017</year>
<volume>70</volume>
<page-range>436-54</page-range></nlm-citation>
</ref>
<ref id="B28">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Rahalkar]]></surname>
<given-names><![CDATA[s]]></given-names>
</name>
</person-group>
<source><![CDATA[A. Certified Ethical Hacker (CEH) Foundation Guide]]></source>
<year>2016</year>
<page-range>207</page-range><publisher-name><![CDATA[Pune, Maharashtra: Springer]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B29">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Sandhya]]></surname>
<given-names><![CDATA[s]]></given-names>
</name>
<name>
<surname><![CDATA[Purkayastha]]></surname>
<given-names><![CDATA[s]]></given-names>
</name>
<name>
<surname><![CDATA[Joshua]]></surname>
<given-names><![CDATA[e]]></given-names>
</name>
<name>
<surname><![CDATA[Deep]]></surname>
<given-names><![CDATA[a]]></given-names>
</name>
</person-group>
<source><![CDATA[Assessment of website security by penetration testing using Wireshark]]></source>
<year>2017</year>
<page-range>1-4</page-range><publisher-name><![CDATA[In 2017 4th International Conference on Advanced Computing and Communication Systems (ICACCS).]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B30">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Seacord]]></surname>
<given-names><![CDATA[r. C]]></given-names>
</name>
</person-group>
<source><![CDATA[Java Deserialization Vulnerabilities and Mitigations.]]></source>
<year>2017</year>
<page-range>6-7</page-range><publisher-name><![CDATA[2017 IEEE Cybersecurity Development (SecDev)]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B31">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Shugrue]]></surname>
<given-names><![CDATA[d]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Fighting application threats with cloud-based WAFs]]></article-title>
<source><![CDATA[Network Security]]></source>
<year>2017</year>
<volume>2017</volume>
<numero>6</numero>
<issue>6</issue>
<page-range>5-8</page-range></nlm-citation>
</ref>
<ref id="B32">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Singh]]></surname>
<given-names><![CDATA[a]]></given-names>
</name>
<name>
<surname><![CDATA[Chatterjee]]></surname>
<given-names><![CDATA[k]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Cloud security issues and challenges: A survey]]></article-title>
<source><![CDATA[Journal of Network and Computer Applications]]></source>
<year>2017</year>
<volume>79</volume>
<page-range>88-115</page-range></nlm-citation>
</ref>
<ref id="B33">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Stock]]></surname>
<given-names><![CDATA[a. V. D]]></given-names>
</name>
<name>
<surname><![CDATA[Glas]]></surname>
<given-names><![CDATA[b]]></given-names>
</name>
<name>
<surname><![CDATA[Smithline]]></surname>
<given-names><![CDATA[n]]></given-names>
</name>
<name>
<surname><![CDATA[Gigler]]></surname>
<given-names><![CDATA[t]]></given-names>
</name>
</person-group>
<source><![CDATA[owasp Top 10 2017. The Ten Most Critical Web Application Security Risks.]]></source>
<year>2017</year>
<page-range>50</page-range><publisher-loc><![CDATA[Edtion ed. EE.UU ]]></publisher-loc>
<publisher-name><![CDATA[The OWASP Foundation]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B34">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Topper]]></surname>
<given-names><![CDATA[j]]></given-names>
</name>
</person-group>
<source><![CDATA[Compliance is not security.]]></source>
<year>2018</year>
<volume>2018</volume>
<numero>3</numero>
<issue>3</issue>
<publisher-name><![CDATA[Computer Fraud &amp; Security]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B35">
<nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Vásquez ojeda]]></surname>
<given-names><![CDATA[Agustín Wilmer]]></given-names>
</name>
</person-group>
<source><![CDATA[Diseño de un Sistema de Gestión de Seguridad de Información para la empresa Neointel SAC basado en la norma ISO/IEC 27001: 2013]]></source>
<year>2020</year>
</nlm-citation>
</ref>
<ref id="B36">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Wang]]></surname>
<given-names><![CDATA[r]]></given-names>
</name>
<name>
<surname><![CDATA[Xu]]></surname>
<given-names><![CDATA[g]]></given-names>
</name>
<name>
<surname><![CDATA[Zeng]]></surname>
<given-names><![CDATA[x]]></given-names>
</name>
<name>
<surname><![CDATA[Li]]></surname>
<given-names><![CDATA[x]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[TT-XSS: A novel taint tracking based dynamic detection framework for DOM Cross-Site Scripting]]></article-title>
<source><![CDATA[Journal of Parallel and Distributed Computing]]></source>
<year>2017</year>
</nlm-citation>
</ref>
</ref-list>
</back>
</article>
