Web Portal Validation Model by Digital Signature and ISO 27002 to Reduce Private Credentials Theft for Phishing Attacks to Financial Sector Customers

Villanueva J.; Sebastian J.; Dextre J. · International Conference on Electrical, Computer, and Energy Technologies, ICECET 2024 (2024) · DOI: 10.1109/icecet61485.2024.10698713

Resumen

Phishing attacks increase by 46% since 2018, mainly affecting the financial sector with losses on average of 3.66 million during 2019. The poor validation procedures of legitimate websites and the carefree aptitude of users in the face of this type of attack have generated their proliferation. The proposed model is divided into the phases of analysis, design, development, experimentation and monitoring; in which the necessary tools are selected, the system architecture is designed considering the criteria of effectiveness, performance, functionality, security and perception of usefulness; It is developed in three layers: backend, middleware, and frontend. The data transfer between the layers implemented the concepts of digital signature in the use of the hash algorithm, asymmetric key and QR codes updated at time intervals. The validation process was carried out using a sample of 106 active users of financial institutions, 100 QR codes, 7 stress loads and in accordance with the ISO 27002 standard. The model reduced the theft of confidential information by 88.87% in an interval of 3 to 6 seconds in the validation process with 100% effectiveness. Likewise, it obtained a 100% satisfaction rate and risk management according to ISO 27002 covered the main inherent risks related to sniffing, QR code spoofing, unauthorized access, cessation of operations and increased latency in the validation process.

Instituciones: Universidad Peruana de Ciencias Aplicadas