Evaluating Web Security Resilience Using ISSAF: Evidence from a Public Village Information System

Abstract

The growing adoption of web-based public services has increased the cybersecurity risks faced by government information systems, particularly in small-scale environments with limited security resources. This study assesses the security of a village information system web application using the Information Systems Security Assessment Framework (ISSAF). The assessment was conducted through four stages: information gathering, network mapping, vulnerability assessment, and penetration testing. The findings indicate that the application has a moderate security posture. Information gathering revealed limited public exposure, although the lack of DNSSEC and accessible metadata presents potential security risks. Network mapping showed a small attack surface with only essential ports exposed. Vulnerability assessment identified several medium- and low-severity issues, mainly related to security misconfigurations such as missing HTTP security headers and weak cookie settings, while no critical vulnerabilities were detected. Penetration testing involving SQL injection, cross-site scripting (XSS), brute-force authentication, and denial-of-service simulations did not achieve successful exploitation, demonstrating the effectiveness of existing input validation and access control mechanisms. Overall, the application is resistant to common cyberattacks but remains vulnerable to multi-stage attacks caused by configuration weaknesses. These findings demonstrate the usefulness of ISSAF for evaluating web application security and provide practical recommendations for strengthening cybersecurity in resource-constrained e-government environments.