Teste de Invasão: um relato de experiência em uma instituição pública de ensino no Brasil

Abstract

Currently, the use of technologies grows in institutions making them susceptible to attacks that put their assets at risk, consequently, information security in the environment is demanded. Confidential information leaked and unavailability of acess can cause financial damage and the reputation of an organization. In this sense, intrusion tests are tools that allow validating information security in these environments, through the collection information on the network, mapping and exploiting vulnerabilities by analyzing assets of the organization, ranking the threats and their possible impact on the institution, classify and suggest solutions within the environment. Given this scenario, this monograph discusses and presents the use of pentest intrusion test in the prevention of cyber attacks to organizations, especially to a public educational institution. A survey was carried out on network information, that is, a mapping of vulnerabilities in the environment. The tools in Kali Linux were used: Nmap, Nbtscan, Nessus, Metasploit e Aircrack-ng. Although the mapping points to several vulnerabilities, stand out the NFS Exported Share Information Disclosure and Microsoft Windows SMB Sahres Unprivileged Acess, wich are considered as critical and high risk severity, respectively. Finally, suggestions are presented for the necessary solutions.