Security Assessment of the Oeiras Municipality IT Infrastructure

José Pedro Ferreira Gomes

Key information

Authors:

José Pedro Ferreira Gomes (José Pedro Ferreira Gomes)

Supervisors:

Ricardo Jorge Fernandes Chaves (Ricardo Jorge Fernandes Chaves); Nuno Miguel Carvalho dos Santos (Nuno Miguel Carvalho dos Santos)

Published in

January 28, 2021

Abstract

Information security has become a primary concern for organizations. Due to the complexity of modern IT infrastructures, it is difficult to prevent individuals with malicious intent to gain illegitimate access to information and/or cause damage to data or services maintained by enterprises and public institutions. With each passing month, the number of vulnerabilities discovered easily exceeds the number of the previous month. Thus, at a time when computer attacks are increasingly elaborate, any entity needs to have a robust physical and technological defense. In this work, we focus on a specific organization -- the Oeiras Municipality -- and our goal is to assess the security of the IT infrastructure of this entity. The complexity of this task comes from the fact that this infrastructure has grown to a considerable scale without following a comprehensive, laid out security architecture. As a result, it is currently difficult to understand to what extent this organization is vulnerable to potential cyber-attacks. To address this problem, this thesis presents a systematic security study of the Oeiras Municipality IT infrastructure which involved a three-pronged methodology: we deployed an in-house SIEM - Security Information and Event Management - to assess whether it would help to gain visibility of the security events ocurred in the network, performed a manual vulnerability analysis using commonly used pentesting tools, and conducted a field study to assess the social awareness of employees. We identify several vulnerabilities and provide a set of recommendations to improve the security of this IT infrastructure.