Analisis dan Mitigasi Keamanan Aplikasi E-Raport Menggunakan OWASP Top 10
Abstract
Abstrak
Aplikasi E-Raport menyimpan data akademik, identitas siswa, dan aktivitas penilaian yang bernilai sensitif sehingga membutuhkan pengujian keamanan sejak tahap pengembangan. Penelitian ini bertujuan menganalisis celah keamanan pada kode sumber aplikasi E-Raport berbasis Laravel dengan pendekatan OWASP Top 10 dan Static Application Security Testing (SAST), kemudian menyusun langkah mitigasi yang dapat diterapkan langsung oleh pengembang. Metode penelitian menggunakan eksperimen laboratorium dengan alur shift-left security, meliputi pemetaan aset kode, konfigurasi Snyk Security Analyzer dan SonarQube for IDE, pemindaian statis, klasifikasi temuan berdasarkan OWASP dan CWE, refaktorisasi kode, serta validasi ulang. Hasil penelitian menunjukkan tiga kelompok risiko utama, yaitu penggunaan kredensial statis pada model dan pengujian otomatis, kelemahan kriptografi akibat dependensi rentan, serta kurangnya pengendalian konfigurasi keamanan. Mitigasi dilakukan melalui pemindahan rahasia ke environment variable, hashing dinamis, pembaruan dependensi, dan validasi ulang hingga panel pemindai menunjukkan kondisi clean state. Penelitian ini menegaskan bahwa integrasi SAST di IDE efektif sebagai kontrol awal untuk menurunkan risiko keamanan aplikasi pendidikan sebelum kode masuk ke repositori produksi.
Kata Kunci: E-Raport, OWASP Top 10, SAST, Laravel, Shift-Left Security
Abstract
E-Raport applications process academic records, student identities, and assessment activities that require security controls from the earliest development stage. This study analyzes security weaknesses in the source code of a Laravel-based E-Raport application using the OWASP Top 10 perspective and Static Application Security Testing (SAST), then formulates practical mitigation steps for developers. The research applies a laboratory experiment based on the shift-left security workflow, consisting of code asset mapping, configuration of Snyk Security Analyzer and SonarQube for IDE, static scanning, classification of findings using OWASP and CWE, code refactoring, and rescanning for validation. The results reveal three major risk groups: hardcoded credentials in model and automated testing components, cryptographic weaknesses related to vulnerable dependencies, and insufficient security configuration control. Mitigation was performed by moving secrets into environment variables, applying dynamic hashing, upgrading dependencies, and validating the result until the scanner reported a clean state. The study confirms that IDE-integrated SAST is useful as an early control to reduce security risks in educational web applications before code is merged into production repositories.
Keywords: E-Raport, OWASP Top 10, SAST, Laravel, Shift-Left Security
References
Chess, B., & McGraw, G. (2004). Static analysis for security. IEEE Security & Privacy, 2(6), 76-79. https://doi.org/10.1109/MSP.2004.111
CWE. (2024). CWE-259: Use of hard-coded password. MITRE. https://cwe.mitre.org/data/definitions/259.html
CWE. (2024). CWE-798: Use of hard-coded credentials. MITRE. https://cwe.mitre.org/data/definitions/798.html
Laravel. (2024a). Hashing. Laravel Documentation. https://laravel.com/docs/10.x/hashing
Laravel. (2024b). CSRF protection. Laravel Documentation. https://laravel.com/docs/10.x/csrf
Laravel. (2024c). Configuration. Laravel Documentation. https://laravel.com/docs/10.x/configuration
National Institute of Standards and Technology. (2022). Secure Software Development Framework (SSDF) Version 1.1: Recommendations for mitigating the risk of software vulnerabilities (NIST SP 800-218). https://doi.org/10.6028/NIST.SP.800-218
OWASP Foundation. (2021a). OWASP Top 10: The ten most critical web application security risks. https://owasp.org/Top10/
OWASP Foundation. (2021b). A02:2021 - Cryptographic failures. https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
OWASP Foundation. (2021c). A06:2021 - Vulnerable and outdated components. https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
OWASP Foundation. (2021d). A07:2021 - Identification and authentication failures. https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
OWASP Foundation. (2024). Application Security Verification Standard 4.0.3. https://owasp.org/www-project-application-security-verification-standard/
SonarSource. (2024). SonarQube for IDE documentation. https://docs.sonarsource.com/sonarqube-for-ide/
Snyk. (2024). Snyk Code documentation. https://docs.snyk.io/scan-with-snyk/snyk-code
The PHP Group. (2024). password.
