ICACT20230059 Slide.19
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
We're now at the Q&A session of our presentation. We hope you found the information useful and insightful. We're here to answer any questions you may have about the survey and analysis of web-related security services in Brazilian higher education institutions. Please feel free to ask us any questions or provide us with your feedback.
|
|
ICACT20230059 Slide.18
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
In conclusion, the results of this survey show that there is a low adoption rate of DNSSEC protocol among Brazilian Higher Education Institutions. Additionally, while a significant number of HEIs do support SSL/TLS certificates, an also significant proportion still do not demand their usage. Our analysis also reveals that the majority of HEIs in Brazil are using the latest version of TLS (TLSv1.3), but a considerable number still use a vulnerable version (TLSv1.0).
Given these results, it is imperative that HEIs design an effective and continuous action plan to support the most up-to-date versions of these protocols and to phase out obsolete versions, as well as increase the use of security headers and the DNSSEC protocol, in order to improve their protection of your websites. By creating a baseline of this information, we hope to establish a framework that can be used to track the evolution of cybersecurity maturity in these institutions in the future.
Thank you so much.
|
|
ICACT20230059 Slide.17
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Moving on, let's evaluate the implementation of the security headers X-Content-Type-Options, X-Frame-Options, and X-XSS-Protection. Out of 2528 institutional websites, a concerning 80.02% don't use any security headers, leaving only 19.98% of websites with security headers. When it comes to the implementation of security headers, private institutions are ahead with 16.81% of use, whereas public institutions lag behind with only 3.16% of use.
When looking at the state-level implementation, we see that the states leading in the use of security headers by public institutions are Roraima (20%), Sergipe (10.53%), and Acre (9.09%). On the other hand, the states with the lowest use of security headers are Mato Grosso (1.67%), Paraná (1.70%), and Bahia (2.18%). Unfortunately, the states of Alagoas, Amapá, Maranhão, Tocantins, and Piauí don't have any public institution that uses security headers.
Private institutions, on the other hand, lead in the use of security headers in states such as Rio Grande do Norte (32.14%), Rio Grande do Sul (24.59%), and Sergipe (21.05%). The states with the lowest use of security headers by private institutions are Mato Grosso do Sul (6.25%), Amapá (8.33%), and Mato Grosso (10%).
From these results, it's clear that the implementation of security headers is still in its early stages, especially in public institutions.
|
|
ICACT20230059 Slide.16
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Now we will analyze the results of the use of the worst SSL/TLS protocols in the HTTPS connections established with the institutional websites of Brazilian HEIs.
The results show that a small percentage, 0.20%, of Brazilian HEIs are still using the highly insecure SSLv2 protocol.
Additionally, 1.58% are using the deprecated SSLv3 protocol.
Unfortunately, the results also show that a significant number of institutions, 38.29%, are still using the outdated TLSv1.0 protocol.
By state, Santa Catarina and São Paulo lead in the use of the SSLv2 protocol.
Mato Grosso do Sul, Rio de Janeiro, and Amazonas lead in the use of SSLv3.
And finally, the states of Amapá and Roraima, Rondônia, and Minas Gerais lead in the use of TLSv1.0.
It's important to note that the use of these protocols leaves the connections vulnerable to attacks and puts sensitive information at risk.
|
|
ICACT20230059 Slide.15
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
The slide presents the results of the SSL/TLS algorithms used by Brazilian Higher Education Institutions (HEIs). The data shows that 74.45% of the HEIs use the RSA algorithm, while 10.13% use the ECC algorithm. The RSA algorithm is most popular in the state of Roraima, with 90% of HEIs using it, followed by the states of Rio Grande do Norte (85.71%) and Ceará (80.22%). On the other hand, the state of Amapá leads in the use of the ECC algorithm, with 25% of HEIs using it, followed by Tocantins (20%) and Maranhão (17.02%).
|
|
ICACT20230059 Slide.14
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
The graph on this slide presents the length of the SSL/TLS keys used by Brazilian Higher Education Institutions. It shows that the majority of HEIs use either 2048-bit RSA (65.23%) or 256-bit ECC (9.69%) keys, which are considered secure and of high quality.
However, the results also indicate a timid use of 3072-bit RSA (3.20%) and 384-bit ECC (0.44%) keys, which offer even more protection due to their longer length.
It's worth mentioning that there is only one institution that uses a 1024-bit RSA key, which is considered absurdly insecure.
These results suggest that there is still room for improvement in the level of security offered by Brazilian HEIs.
|
|
ICACT20230059 Slide.13
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Now let's take a look at the results for the certificate authorities of the private HEIs. The R3 CA is responsible for 31.6% of the certifications, followed by AlphaSSL CA-SHA256-G2 with 8.2% and Cloudflare Inc ECC CA-3 with 7.3%. The other CAs account for 15.3% of the total. It's interesting to note that, compared to the public sector, Cloudflare Inc ECC CA-3 and AlphaSSL CA-SHA256-G2 have doubled their market share in the private sector.
|
|
ICACT20230059 Slide.12
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Let's take a look at the results for the certificate authorities of the public HEIs. The R3 CA is the most used, representing 24.7% of the CAs. Cloudflare Inc ECC CA-3 comes in second with 4.4% and AlphaSSL CA-SHA256-G2 with 3.8%. The other CAs account for the remaining 12.2% of certifications. It's worth mentioning that the public HEIs use a greater variety of CAs than the private HEIs.
|
|
ICACT20230059 Slide.11
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Now we will present the results of the analysis of HTTPS configuration in Brazilian HEIs. As we can see from the slide, 40.39% of the institutions offer HTTPS properly, ensuring data protection for their users. On the other hand, 15.43% of the institutions only offer HTTP, which is an insecure protocol. 14.20% of the institutions offer both protocols, but there is no redirection to force the use of HTTPS. This means that users can access the site through the insecure protocol. 28.72% of the institutions have invalid SSL configuration, which means there are errors in their certificate or settings.
These results show the importance of ensuring secure communication in HEIs and the need for improvement in the configuration of these services.
|
|
ICACT20230059 Slide.10
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Now let's move on to our results on the adoption of DNSSEC in Brazilian Higher Education Institutions. As shown in the graph, 98% of the HEIs do not implement DNSSEC, with only 0.71% of public HEIs and 1.34% of private HEIs configured to use it. This highlights the fact that DNSSEC deployment in Brazilian HEIs is still in its early stages, representing a vulnerability for DNS attacks such as spoofing or cache poisoning.
|
|
ICACT20230059 Slide.09
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Now we are going to present the results of our research, starting with the distribution of Higher Education Institutions in Brazil by state and category.
The results show a total of 2528 HEIs in Brazil, distributed across the states. As you can see, most institutions (87.34%) are private, while only 12.66% are public.
São Paulo is the state with the highest number of institutions, followed by Minas Gerais and Rio de Janeiro. On the other hand, the states with the lowest number of institutions are Amapá, Acre, and Roraima.
When analyzing the category of the institution, we can see that the states with the highest percentage of private institutions are Mato Grosso, Maranhão, and Rondônia. Meanwhile, the states with the highest percentage of public institutions are Roraima, Amapá, and Rio de Janeiro.
It is also important to mention that 16% of the Brazilian HEIs did not have their institutional website registered.
|
|
ICACT20230059 Slide.08
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Moving on to the Methodology slide. Our research was conducted through a quantitative approach, utilizing an exploratory and descriptive nature. We aimed to represent the phenomenon of web-related security services in Brazilian Higher Education Institutions through a representative sample of the target population.
Our first step was to collect publicly available information from all Higher Education Institutions registered in the National Registry of Higher Education Courses and Institutions of the Ministry of Education and Culture of Brazil. This was done using a Web Crawler algorithm that analyzed the MEC website’s source code.
After collecting the information, we normalized and processed the data using Pentaho Data Integration software. Out of the 3,044 registered institutions, 2,528 were used for our research as 516 did not have an institutional website registered in MEC.
To gather information on the status of DNSSEC and HTTPS services, two modules were developed using Python programming language. The multiple items collected were recorded in a CSV format file. Our research was carried out in April and May of 2022 and all the survey data is available on the GitHub platform.
|
|
ICACT20230059 Slide.07
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Finally, we come to the study that inspired this work - a previous survey of the security status of websites in Portuguese Higher Education Institutions. This study provided valuable insights into the state of security in these institutions and served as a foundation for our research. Building on their findings, we expanded the scope of the study to include security headers and analyzed data from a much larger sample of institutions in Brazil, one of the largest Portuguese-speaking countries in the world.
|
|
ICACT20230059 Slide.06
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Another area of focus in our literature review, of course, was the widespread use of HTTPS on websites, and its impact on security. According to the study, despite the increasing adoption of HTTPS, many websites are still misconfigured, leaving their users exposed to various security threats. This finding highlights the need for proper implementation and configuration of HTTPS to ensure the security of websites and their users.
|
|
ICACT20230059 Slide.05
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Moving on, we come to a study that looked at the impact of security headers on websites. The results showed that the adoption of security headers was still low among websites, despite their proven effectiveness in improving the security of websites. This finding is significant because security headers are an essential aspect of website security and play a crucial role in preventing attacks such as cross-site scripting, cross-site request forgery, and clickjacking.
|
|
ICACT20230059 Slide.04
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
So, let's now talk about the Related Works. In this section, we'll be discussing the works that inspired this study and the studies that have been carried out in the area.
Let's start by talking about the studies that investigated the vulnerability of the DNS. As we all know, the DNS is a crucial component of the internet infrastructure, and its security is essential for a secure and stable internet. In this study, researchers focused on two major types of DNS attacks: cache injection and poisoning. They found that these types of attacks are still a significant threat to the security of the internet and that measures such as DNSSEC can help mitigate these risks.
|
|
ICACT20230059 Slide.03
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
The question we set out to answer in this study is: What is the current state of cybersecurity for the websites of Brazilian Higher Education Institutions, and what areas present potential for improvement?
To answer this question, we had three specific objectives.
The first objective was to identify the current state of cybersecurity for the websites of Brazilian Higher Education Institutions.
The second objective was to identify potential areas for improvement.
And finally, the third objective was to establish a framework to track the evolution of cybersecurity maturity among these institutions in the future.
We collected data on DNSSEC adoption, HTTPS redirection, security header usage, and SSL/TLS certificate information from all Brazilian Higher Education Institutions that had an institutional website registered in the Ministry of Education of Brazil. We analyzed 2,528 records and found some surprising results, which we will be sharing with you in the next few slides.
|
|
ICACT20230059 Slide.02
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
As we all know, cybersecurity is an essential aspect of technology in today's world, and this is especially true for Higher Education Institutions. These institutions store sensitive information, have many online services, and provide access to these services to a large number of users. It is critical for them to implement effective security measures to protect their systems and data and ensure safe access for their users.
The focus of our study is to understand the status of two web-related security services in Brazilian Higher Education Institutions: HTTPS and DNSSEC. Our goal is to identify the current state of cybersecurity in these institutions and to identify areas for improvement.
In the next slide, we will present our Statement of the Problem, where we will delve into the specifics of our study.
|
|
ICACT20230059 Slide.01
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
In the next few minutes, I will be discussing the following topics:
Introduction to the study, including the background and objectives.
Statement of the problem, outlining the challenges and objectives that the research aims to address.
Review of the related literature, summarizing relevant studies and theories related to the topic.
Methodology, explaining the techniques and processes used to conduct the research.
Results, presenting the findings and analysis of the collected data.
Conclusion, summarizing the key takeaways from the research and discussing its implications.
Q&A, allowing you to ask questions and engage in a discussion.
So, let's begin by diving into the introduction of our study.
|
|
ICACT20230059 Slide.00
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Hello everyone, I am Jackson Júnior, and I would like to thank you for joining us today to hear about our research on the status of web-related security services in Brazilian Higher Education Institutions. I am proud to present this research, carried out in collaboration with two esteemed researchers, Dr. Hugo Almeida and Dr. Pedro Pinto. This research was supported by the project “Cybers SeC IP”. This support allowed us to conduct an in-depth investigation into the state of web-related security services in Brazilian HEIs.
|
