Aplicación del proceso threat hunting para la detección de vulnerabilidades y contramedidas en la infraestructura de red del Cuerpo de Bomberos de Ambato.

Abstract

The security of the network infrastructure of Ambato Fire Department takes on a vital role, as it houses sensitive and strategic data for the functioning of its operations. Given the constant increase in cyberattacks and the ongoing evolution of tactics employed by malicious actors, it is essential to have an effective strategy that enables the identification and mitigation of threats in real time. In this context, this work proposes the development of a comprehensive manual to implement the Threat Hunting process in the network of Ambato Fire Department. Utilizing a variety of specialized cybersecurity tools such as Wireshark, Nessus, and Advanced IP Scanner. Additionally, a manual analysis of log files was conducted, delving into the understanding of their handling and their relevance in the realm of cybersecurity. As a complement, a Python code was developed to enhance the analysis, with the purpose of identifying and addressing vulnerabilities that could jeopardize the solidity of the network infrastructure. This approach not only allowed for the detection of security weaknesses but also paved the way for the planning of various countermeasures aimed at strengthening the identified susceptible points in the network. Finally, the process was documented to ensure the traceability and replicability of the undertaken actions.