Evaluación de herramientas de software para la detección de vulnerabilidades y malas prácticas de seguridad en arquitecturas cloud nativas - <Google Cloud>

Abstract

Abstract: Security in native cloud architectures, such as Google Cloud Platform (GCP), is of vital importance due to the constant increase in the adoption of these services by enterprises and users. Therefore, in this degree work, a test scenario architecture is proposed to evaluate the effectiveness of several tools specialized in vulnerability identification and management, with a particular focus on OWASP top ten vulnerabilities. In this context, the OWASP tools ZAP, Nessus, OpenVAS and SonarQube will be used. These tools will be applied to a number of applications designed to exhibit security vulnerabilities, such as OWASP&#39;s Juice Shop and Damn Vulnerable Web Application (DVWA) , as well as Avocano , an e-commerce application provided by Google Cloud Platform (GCP) startup solutions. Deploying these applications in a native cloud environment will allow simulating real situations and evaluating the ability of these tools to detect and report vulnerabilities effectively.