Title:	3SW : um modelo adaptado do CIS Controls v8.1 para mitigação de ameaças a servidores Web
Authors:	Silva, Tássio Correia da
Orientador(es)::	Mendes, Fabiana Freitas
Assunto::	Segurança da informação Servidores da Web Administração pública Segurança cibernética
Issue Date:	22-Dec-2025
Data de defesa::	26-Aug-2025
Citation:	SILVA, Tássio Correia da. 3SW: um modelo adaptado do CIS Controls v8.1 para mitigação de ameaças a servidores Web. 2025. 103 f., il. Dissertação (Mestrado Profissional em Engenharia Elétrica) — Universidade de Brasília, Brasília, 2025.
Abstract:	The increasing dependence on technology and the expansion of digital services, combined with a significant rise in cyber threats, require that Public Administration improve its information security maturity, particularly concerning critical assets such as web servers. Therefore, it is essential to reduce immediate risks and strengthen cybersecurity through practical, applicable, and prioritized actions. This thesis introduces the 3SW model (Subset of Safeguards for Web Servers), a specific set of security measures derived from the CIS Controls v8.1, designed to protect web servers in institutional environments. The research methodology for developing the 3SW was based on an adaptation of the content analysis proposed by Bardin, structured in three phases: Pre-analysis, Application of Criteria, and Analysis of Results. Using qualitative criteria, 93 security measures were selected, distributed across 17 of the 18 controls in CIS Controls v8.1, with a focus on web servers. The model was then validated through a case study. First, we conducted a diagnosis in the organization where the model would be implemented using document analysis and interviews. The 3SW model was subsequently applied to the Alpaca System, while the reference model WAH (Web Application Hacking from the Community Defense Model) was used in the Llama System. Finally, the results were compared to determine the effectiveness of the 3SW model. The diagnosis revealed that although the CIS Controls were already implemented within the organization through the Privacy and Information Security Program (PPSI), their general application did not fully address the specific needs of web servers. Some observed limitations included lack of focus on web servers and low granularity in the evaluation scales. The comparison of the application results of the models in the two systems indicated that the 3SW model achieved 82% effectiveness (76 of 93 measures implemented) and 97% coverage of active mitigations (based on MITRE ATT&CK). In contrast, the WAH model achieved 74% effectiveness and 95% coverage. Moreover, the 3SW demonstrated greater completeness per control, with 59% of controls fully implemented compared to 38% for the WAH model. This indicates that the 3SW model is better aligned with the technical needs of web servers and with the operational context of the public agency that participated in the case study. The 3SW represents a practical proposal that could significantly improve the cybersecurity of Public Administration, working synergistically with the existing PPSI. Additionally, due to its rigorous methodological approach, practical results, and institutional relevance, this research can contribute to the academic and technical discussions on the contextualized application of security frameworks and the protection of strategic assets in public environments.
metadata.dc.description.unidade:	Faculdade de Tecnologia (FT) Departamento de Engenharia Elétrica (FT ENE)
Description:	Dissertação (mestrado) — Universidade de Brasília, Faculdade de Tecnologia, Departamento de Engenharia Elétrica, Programa de Pós-Graduação em Engenharia Elétrica, 2025.
metadata.dc.description.ppg:	Programa de Pós-Graduação em Engenharia Elétrica, Mestrado Profissional
Licença::	A concessão da licença deste item refere-se ao termo de autorização impresso assinado pelo autor com as seguintes condições: Na qualidade de titular dos direitos de autor da publicação, autorizo a Universidade de Brasília e o IBICT a disponibilizar por meio dos sites www.unb.br, www.ibict.br, www.ndltd.org sem ressarcimento dos direitos autorais, de acordo com a Lei nº 9610/98, o texto integral da obra supracitada, conforme permissões assinaladas, para fins de leitura, impressão e/ou download, a título de divulgação da produção científica brasileira, a partir desta data.
Appears in Collections:	Teses, dissertações e produtos pós-doutorado

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.