Evaluasi Security Posture Aplikasi Web EGISS Menggunakan Vulnerability Assessment, Penetration Testing, dan Risk-Based Mitigation

Abstract

Web application security has become a critical aspect of ensuring the confidentiality, integrity, and availability of organizational information, particularly for Small and Medium Enterprises (SMEs) that increasingly rely on web-based systems to support business operations. However, most penetration testing studies primarily focus on vulnerability identification without evaluating the effectiveness of the implemented mitigation measures. This study aims to evaluate the security posture of the EGISS web application by integrating vulnerability assessment, penetration testing, risk-based mitigation, retesting, and post-mitigation security posture evaluation. The assessment was conducted using the OWASP Top 10 as the vulnerability classification framework and NIST SP 800-115 as the penetration testing guideline. Vulnerability identification was performed using Burp Suite Professional, OWASP ZAP, and Nikto, followed by manual validation, risk assessment, mitigation implementation, and retesting. The results identified eleven priority vulnerabilities consisting of seven High-severity and four Medium-severity findings. After the mitigation process, all High-severity vulnerabilities were successfully eliminated, while the number of priority vulnerabilities decreased from eleven to three Medium-severity findings, representing a 72.73% reduction. These findings demonstrate that the proposed approach effectively improves the security posture of the EGISS web application. This study proposes a security evaluation approach that integrates vulnerability identification, validation, risk-based mitigation, retesting, and security posture evaluation in one testing cycle so that it can be a reference for organizations and MSMEs in improving web application security.