The DOI matches its Crossref record; 12 of the 12 references it cites were found in a registry or an index; none of the 16 sources its claims cite is checked for support yet.
Information Technology Risk Management Using ISO 31000 Based on the ISSAF Penetration Testing Framework
Open accessAbstract
Information security is critical for higher education institutions, which manage large amounts of sensitive data in the digital age. Data breach incidents in Indonesia's academic sector reached 2,217 in 2021. A university website with 36 web-based information system services was found to have been defaced. SQL injection and XSS attacks, which can lead to data breaches, system manipulation, and disruption of academic services, are also common. These attacks underscore the importance of strong security measures to protect data and preserve the reputation of education. This research assesses the security risk of the XYZ University website using the ISSAF and ISO 31000. ISSAF was applied in four stages: information gathering, network mapping, vulnerability identification, and penetration testing with customization for university web systems. ISO 31000 was used to assess risk severity, resulting in classifications of two high, six medium, and twelve low risks. Security recommendations were developed to address the key risks and can be applied to other universities facing similar threats. The findings provide great insight for educational institutions to strengthen their cybersecurity. Implementing appropriate measures not only improves privacy, but also builds trust and reputation. Proactive information security is becoming a critical asset for the sustainability and credibility of higher education institutions in this vulnerable digital age
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
This paper applies ISSAF penetration testing and ISO 31000 risk management to assess the security of the XYZ University website. It reports two high, six medium, and twelve low risks and recommends mitigations focused on high- and medium-level vulnerabilities.
Key findings
- ISSAF information gathering obtained 18 of 30 desired pieces of information (60% success), and network mapping collected 15 of 21 information types; SSH (22), HTTP (80), and HTTPS (443) ports were open across domains.
- High-level vulnerabilities included Blind SQL Injection and Cross-Site Scripting (XSS) on `xyz.ac.id`, and Blind SQL Injection on `reg.xyz.ac.id`; medium-level issues included readable `.htaccess`, missing CSRF protection, and `allow_url_fopen` enabled.
- Penetration testing succeeded with SQL Injection on `xyz.ac.id` via a POST request to `/wisuda/` targeting `idprodi`, and on `ppid.xyz.ac.id` via a GET request to `/page.php?idn=79`; XSS and Local File Inclusion tests failed on the listed subdomains.
- ISO 31000 risk management identified 22 risks; the abstract and conclusion classify two as high, six as medium, and twelve as low, while Table IX labels R10, R11, R12, R13, and R15 as High and R16, R19, and R20 as Medium. Recommended mitigations include parameterized queries, Content Security Policy, CSRF protection, file upload validation, and restricted backup access.
Methods
- Case study of the XYZ University website using ISSAF in four stages: information gathering, network mapping, vulnerability identification, and penetration testing. Tools included Whois Domain, Reverse IP Lookup Scanner, Spamhaus, Nmap, and Traceroute, run on Windows 11 and Kali Linux.
- ISO 31000 risk management followed risk identification, risk analysis, and risk evaluation. Likelihood and impact were scored on a 1–5 scale by an expert panel of IT security and stakeholders, with recommendations divided into immediate, short-term, and long-term phases.
Limitations
- The paper states that testing permission was limited to the penetration stage only, and that recommendations for low-level risks were simplified or removed because they did not significantly contribute to overall risk.
- Evident from the text: risk classifications are internally inconsistent—the abstract and conclusion report two high, six medium, and twelve low risks, while Table IX lists five high and three medium risks. The study is also a single anonymized university case study, though the paper suggests the framework can be adapted as a template for other educational institutions.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Figures
Verification
Claims the paper makes
15 Own result · 13 Sources not found · 10 Own interpretation · 5 Own method
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Pada Tabel 3, hasil identifikasi kerentanan menunjukkan bahwa domain xyz.ac.id memiliki beberapa kerentanan tingkat tinggi seperti Blind SQL Injection dan Cross-Site Scripting (XSS).”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
hedgedSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Dari total 30 informasi yang diinginkan, 18 informasi berhasil diperoleh, dengan tingkat keberhasilan sebesar 60%.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Tabel 5 menunjukkan 22 risiko spesifik yang ditemukan selama pengujian, masing-masing dikategorikan berdasarkan sumber risiko dan dampaknya.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Temuan penting meliputi port SSH (22), HTTP (80), dan HTTPS (443) yang terbuka di seluruh domain.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“ISO 31000 was used to assess risk severity, resulting in classifications of two high, six medium, and twelve low risks.”
- Also stated in: § Data availability · plain
“ISO 31000 digunakan untuk mengevaluasi keparahan risiko, menghasilkan klasifikasi dua risiko tinggi, enam sedang, dan dua belas rendah..”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > Abstract
plaindirectSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Also stated in: § Data availability · plain
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Serangan ini dilakukan dengan memanfaatkan parameter POST dan GET tanpa validasi yang memadai, sehingga penyerang dapat mengakses dan memodifikasi basis data.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Sementara itu, domain lainnya, seperti reg.xyz.ac.id, menunjukkan kerentanan tingkat sedang, seperti file .htaccessyang dapat dibaca, yang memungkinkan penyerang mengakses pengaturan server untuk eksploitasi lebih lanjut.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plainSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Hasil yang disajikan dalam Tabel 2 mengungkapkan bahwa 15 dari 21 jenis informasi berhasil dikumpulkan.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Gambar 5 menunjukkan matriks evaluasi risiko yang mengidentifikasi konsentrasi risiko di area web application security dan access control.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Evaluasi risiko mengungkapkan dua risiko dengan tingkat tinggi, yaitu Blind SQL Injection dan kerentanan terkait unggahan file.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > IV. KESIMPULAN
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Pada Tabel 4 dapat terlihat hasil pengujian penetrasi menunjukkan keberhasilan serangan SQL Injection pada dua domain: xyz.ac.id dan ppid.xyz.ac.id.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Namun, pengujian Cross-Site Scripting (XSS) dan Local File Inclusion (LFI) pada beberapa subdomain gagal”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“Data breach incidents in Indonesia's academic sector reached 2,217 in 2021.”
- Also stated in: § I. PENDAHULUAN · plain
“Kebocoran data di sektor pendidikan, termasuk universitas, juga menjadi target signifikan bagi pelaku serangan siber, dengan laporan meningkatnya aktivitas serangan terhadap sektor akademik di Indonesia, mencapai 2.217 kasus web defacement pada tahun 2021 [6].”
- Also stated in: § Data availability · plain
“Insiden kebocoran data di sektor akademik Indonesia mencapai 2.217 pada tahun 2021.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > Abstract
What the sources say
- Not matchedcites [6]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Also stated in: § I. PENDAHULUAN · plain
In the paper
“Berdasarkan observasi pada 19 Mei 2021, ditemukan bahwa situs web universitas tersebut telah diserang, dengan salah satu laman yang mengalami defacement [7].”
- Also stated in: § Data availability · plain
“Laman situs web universitas yang memiliki 36 layanan sistem informasi berbasis web ditemukan telah mengalami defacement.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > I. PENDAHULUAN
What the sources say
- Not matchedcites [7]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Also stated in: § Data availability · plain
In the paper
“Universitas sering menjadi target utama serangan siber karena mereka menyimpan data sensitif dan mengoperasikan infrastruktur kritis [3].”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > I. PENDAHULUAN
What the sources say
- Not matchedcites [3]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Penilaian dilakukan dengan menggunakan best practices dari ISO 31000, yang telah disesuaikan dengan konteks keamanan institusi pendidikan.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > Additional information
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- It may state two separate claims as one. 19
- Probably not a substantial claim. 13
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Beberapa risiko dengan level tinggi (R10 dan R15) memerlukan perhatian segera, sementara risiko lainnya berada di zona medium yang masih memerlukan mitigasi jangka panjang.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Selain itu, terdapat enam risiko dengan tingkat sedang, termasuk kerentanan XSS dan akses tidak aman terhadap file sensitif, serta beberapa risiko dengan tingkat rendah yang tidak berpengaruh signifikan terhadap sistem.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > IV. KESIMPULAN
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Melalui proses ini, teridentifikasi beberapa celah keamanan, seperti Blind SQL Injection, akses tidak aman terhadap file cadangan, dan kurangnya perlindungan terhadap CSRF, XSS dan lain-lain.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > IV. KESIMPULAN
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Hal ini membuka peluang bagi penyerang untuk melakukan serangan brute force atau mengeksploitasi kerentanan web yang ditemukan pada layanan-layanan ini.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“framework ini dapat diadaptasi sesuai dengan karakteristik dan kebutuhan masing-masing institusi.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Hasil dari penelitian ini dapat diadopsi sebagai template untuk pengembangan framework keamanan pada institusi pendidikan lain yang memiliki kebutuhan keamanan serupa.”
- Also stated in: § Abstract · plain
“Security recommendations were developed to address the key risks and can be applied to other universities facing similar threats.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plainSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence.
- Also stated in: § Abstract · plain
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Metodologi ini memastikan bahwa penilaian risiko konsisten dan dapat digunakan untuk menentukan langkah mitigasi yang paling efektif.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“yang mengindikasikan bahwa mekanisme keamanan untuk serangan tersebut bekerja dengan baik, meski masih memerlukan penguatan lebih lanjut.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Kerentanan unggahan file juga memungkinkan penyerang untuk memasukkan file berbahaya ke dalam sistem, yang dapat menyebabkan peretasan lebih lanjut atau merusak sistem internal universitas.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > IV. KESIMPULAN
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
None of the sources cited for this claim could be matched to a paper in Crossref, so there is nothing to check it against.
In the paper
“ISO 31000 adalah standar manajemen risiko internasional yang diterbitkan oleh International Organization for Standardization pada 13 November 2009, sebagai pengganti AS/NZS 4360:2004 [20], [21].”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > B. Manajemen Resiko
What the sources say
- Not matchedcites [20]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Not matchedcites [21]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Not matched
In the paper
“Pengujian ini memberikan informasi rinci tentang ancaman aktual dan membantu organisasi mengatasi masalah keamanan dengan cepat [15].”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > A. Pengujian Penetrasi
What the sources say
- Not matchedcites [15]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Not matched
In the paper
“Pengujian real-time pada aplikasi web terbukti efektif meningkatkan keamanan dan mengidentifikasi celah [14]”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > A. Pengujian Penetrasi
What the sources say
- Not matchedcites [14]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Not matched
In the paper
“Meskipun berbagai metode keamanan telah diterapkan, implementasinya sering kali kurang optimal, membuka peluang bagi peretas untuk mengeksploitasi sistem [8].”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > I. PENDAHULUAN
What the sources say
- Not matchedcites [8]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: unclear — It is unclear whether it could be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Blind SQL Injection, sebagai salah satu kerentanan tingkat tinggi, memungkinkan penyerang untuk memodifikasi kueri basis data yang dapat mengakibatkan pencurian data sensitif atau perubahan data yang merusak, seperti nilai akademik mahasiswa.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > IV. KESIMPULAN
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
In the paper
“ISSAF menyediakan metodologi pengujian penetrasi yang komprehensif, membantu penguji menghindari kesalahan akibat serangan yang tidak terstruktur [19].”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > B. Manajemen Resiko
What the sources say
- Not matchedcites [19]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Not matched
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Setiap risiko dikategorikan dalam tiga tingkatan: tinggi, sedang, dan rendah, berdasarkan hasil dari panel ahli yang terdiri dari tim IT security dan stakeholders utama.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: The expert panel's risk categorization is valid and reliable.
None of the sources cited for this claim could be matched to a paper in Crossref, so there is nothing to check it against.
In the paper
“Pengujian penetrasi membantu mengidentifikasi kerentanan, kesalahan konfigurasi sistem, serta kelemahan operasional [11], [12].”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > A. Pengujian Penetrasi
What the sources say
- Not matchedcites [11]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Not matchedcites [12]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Temuan ini menunjukkan tingginya tingkat eksposur informasi publik pada domain xyz.ac.id, yang memudahkan peretas untuk menyusun strategi serangan lebih lanjut.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plaindirectSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“mengingat batasan izin yang diberikan oleh pihak terkait hanya mencakup hingga tahap penetrasi.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > IV. KESIMPULAN
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Integrasi ISO 31000 dan ISSAF memungkinkan evaluasi risiko berdasarkan hasil pengujian penetrasi, memastikan kelemahan keamanan dikelola secara sistematis, membantu universitas memprioritaskan perbaikan, dan mengurangi risiko pada sistem informasi mereka.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > B. Manajemen Resiko
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
In the paper
“ISO 31000 menyediakan panduan umum yang perlu disesuaikan dengan konteks spesifik organisasi [17].”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > B. Manajemen Resiko
What the sources say
- Not matchedcites [17]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Beberapa risiko dengan potensi dampak besar seperti Blind SQL Injection (R10) dan Cross-site Scripting (R11) memerlukan mitigasi segera karena dapat mempengaruhi data dan operasional situs web universitas.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“Sebagai contoh, salah satu universitas di Indonesia memiliki 36 layanan sistem informasi berbasis web yang dapat diakses melalui portal daringnya.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > I. PENDAHULUAN
What the sources say
- Not matchedcites [7]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
None of the sources cited for this claim could be matched to a paper in Crossref, so there is nothing to check it against.
In the paper
“Serangan seperti SQL Injection dan Cross-Site Scripting (XSS) kerap terjadi, yang dapat mengakibatkan kebocoran data, manipulasi sistem, hingga gangguan layanan akademik [4], [5].”
- Also stated in: § Abstract · plain
“SQL injection and XSS attacks, which can lead to data breaches, system manipulation, and disruption of academic services, are also common.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > I. PENDAHULUAN
What the sources say
- Not matchedcites [4]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Not matchedcites [5]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Also stated in: § Abstract · plain
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Kerentanan ini dapat dimanfaatkan dalam serangan nyata, seperti mengakses data pengguna atau mengubah data tanpa izin yang dapat menyebabkan gangguan serius pada operasional situs.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Manajemen risiko TI membantu eksekutif menghemat sumber daya dan mengintegrasikannya ke dalam manajemen risiko perusahaan secara keseluruhan serta memberikan panduan praktis bagi kepemimpinan [9].”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > B. Manajemen Resiko
What the sources say
- Not matchedcites [9]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Not matched
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Setiap tingkat kriteria, baik untuk kemungkinan (Tabel 6) maupun dampak (Tabel 7), telah dikalibrasi dengan data historis serangan yang pernah terjadi di universitas lain”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > Additional information
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Rests on an assumption: Historical attack data from other universities are applicable for calibrating likelihood and impact criteria for XYZ University.
The paper relies on this without support.
Universitas XYZ manages large amounts of sensitive personal data of students and staff, including academic and financial data, making it vulnerable to cyber attacks.
“Universitas ini mengelola sejumlah besar data pribadi mahasiswa dan staf, termasuk data akademik dan keuangan, yang bersifat sensitif dan rahasia, sehingga rentan terhadap ancaman serangan siber.”
The paper relies on this without support.
Historical attack data from other universities are applicable for calibrating likelihood and impact criteria for XYZ University.
“Setiap tingkat kriteria, baik untuk kemungkinan (Tabel 6) maupun dampak (Tabel 7), telah dikalibrasi dengan data historis serangan yang pernah terjadi di universitas lain”
The paper relies on this without support.
The expert panel's risk categorization is valid and reliable.
“Setiap risiko dikategorikan dalam tiga tingkatan: tinggi, sedang, dan rendah, berdasarkan hasil dari panel ahli yang terdiri dari tim IT security dan stakeholders utama.”
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated major: it would touch a result — a value a result rests on, reported and recomputed p-values on opposite sides of the significance level, two passages that conflict with no sign which is right, or a cited work retracted before this paper was published.
In the paper
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > IV. KESIMPULAN
“Evaluasi risiko mengungkapkan dua risiko dengan tingkat tinggi, yaitu Blind SQL Injection dan kerentanan terkait unggahan file.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
“R12 High (Possible + Major)”
Rated major: it would touch a result — a value a result rests on, reported and recomputed p-values on opposite sides of the significance level, two passages that conflict with no sign which is right, or a cited work retracted before this paper was published.
In the paper
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > Additional information
“R16 Unlikely (2) Minor (2)”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
“R16 Medium (Possible + Moderate”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > Additional information
“R15 Likely (4) Major (4)”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
“R15 High (Possible + Major)”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
“R16 .htaccess File Readable File .htaccessterbaca publik.Informasi aturan server terekspos, memudahkan eksploitasi.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
“R16 Medium (Possible + Moderate -Tambahkan atribut HttpOnly dan Secure pada cookies untuk mencegah serangan XSS dan melindungi data sesi pengguna.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
“R20 Possible (3) Minor (2)”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
“R20 Medium (Possible + Moderate”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > Abstract
“resulting in classifications of two high, six medium, and twelve low risks.”
§ INFORMATION TECHNOLOGY RISK MANAGEMENT USING ISO 31000 BASED ON THE ISSAF PENETRATION TESTING FRAMEWORK MANAJEMEN RISIKO TEKNOLOGI INFORMASI MENGGUNAKAN ISO 31000 BERBASIS KERANGKA KERJA PENGUJIAN PENETRASI ISSAF > III. HASIL DAN PEMBAHASAN
“Tabel 5 menunjukkan 22 risiko spesifik yang ditemukan selama pengujian, masing-masing dikategorikan berdasarkan sumber risiko dan dampaknya.”
Citations
Cites
An Overview of Penetration Testing
Bacudio, A. G., Yuan, X., Chu, B.-T. B., & Jones, M. (2011) · International Journal of Network Security & Its Applications · doi:10.5121/ijnsa.2011.3602 · Cited by 105
Information security policies’ compliance: a perspective for higher education institutions
Hina, S., & Dominic, P. D. D. (2018) · Journal of Computer Information Systems · doi:10.1080/08874417.2018.1432996 · Cited by 97
Hariyadi, D., & Nastiti, F. E. (2021) · Jurnal Komtika (Komputasi dan Informatika) · doi:10.31603/komtika.v5i1.5134 · Cited by 33
WebApplication Vulnerabilities:Exploitation and Prevention
Priyanka, A. K., & Smruthi, S. S. (2020) · International Conference on Inventive Research in Computing Applications (ICIRCA) · doi:10.1109/icirca48905.2020.9182928 · Cited by 25
Sanjaya, I. G. A. S., Sasmita, G. M. A., & Arsa, D. M. S. (2020) · International Journal of Computer Network and Information Security · doi:10.5815/ijcnis.2020.04.03 · Cited by 22
Analysis of Web Application Code Vulnerabilities using Secure Coding Standards
Sahu, D. R., & Tomar, D. S. (2016) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-016-2362-5 · Cited by 15
Security Analysis of Grr Rapid Response Network using COBIT 5 Framework
Riadi, I., Sunardi, S., & Handoyo, E. (2019) · Lontar Komputer Jurnal Ilmiah Teknologi Informasi · doi:10.24843/lkjiti.2019.v10.i01.p04 · Cited by 10
Tedyyana, A., Ghazali, O., Asnafi, T., Purbo, O. W., Harun, N. Z., & Riza, F. (2024) · TELKOMNIKA (Telecommunication Computing Electronics and Control) · doi:10.12928/telkomnika.v22i2.25758 · Cited by 8
Sukapto, P., Desena, J. D. H., Ariningsih, P. K., & Susanto, S. (2018) · International Journal of Simulation Systems Science & Technology · doi:10.5013/ijssst.a.19.04.22 · Cited by 4
Enhance Telecommunication Security Through the Integration of Support Vector Machines
Tedyyana, A., Ahmad, A., Idrus, M. R., Shabli, A. H. M., Seman, M. A. A., Ghazali, O., Jaroji, J., & Razak, A. H. A. (2024) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2024.0150364 · Cited by 4
Research works printed but not linked: 4
- M. Z. Hasan, M. Z. Hussain, M. Taimoor, and A. Chughtai, "Penetration Testing In System Administration," INTERNATIONAL JOURNAL OF SCIENTIFIC & TECHNOLOGY RESEARCH, vol. 6, no. 06, 2017, [Online]. Available: www.ijstr.org
- M. Mirjalili, A. Nowroozi, and M. Alidoosti, "A survey on web penetration test," 2014. [Online]. Available: https://www.researchgate.net/publication/270523617
- R. H. Hutagalung, L. E. Nugroho, and R. Hidayat, "Analisis Uji Penetrasi Menggunakan ISSAF," Hacking Digit. Forensics Expo, pp. 32-40, 2017.
- A. Lubis and A. Tarigan, "Security Assessment of Web ApplicationThrough Penetration System Techniques," Jend. Gatot Subroto Km, vol. 4, no. 100, pp. 296-303, 2017.
Cited by
Sorted by citations
A Systematic Literature Review of Information Security Practices in Higher Education Contexts
Bwiino, K., Kituyi, G. M., Nkamwesiga, L., & Nyamadi, M. (2026) · IET Information Security · doi:10.1049/ise2/6324508 · Cited by 5
Azizah, N. A., Saskara, G. A. J., & Santyadiputra, G. S. (2026) · Kumpulan Artikel Mahasiswa Pendidikan Teknik Informatika (KARMAPATI) · doi:10.23887/karmapati.v15i2.114689 · Cited by 1
Metadata
- Authors
- Firdaus, M. A., Perdianza, M. E., & Indah, D. R.
- Affiliations
- Sriwijaya University (ID)
- Venue
- INOVTEK Polbeng - Seri Informatika
- Publisher
- Politeknik Negeri Bengkalis
- Published
- 2024-10-24
- Volume
- 9
- Issue
- 2
- Pages
- 839-851
- ISSN
- 2527-9866 (ISSN-L)
- OpenAlex
- W4404773496
- Semantic Scholar
- 7a0a744fcbf34837d090051ba366b8aba597706c
- Cited by
- 2
- References
- 9
- Citations by year
- 2026: 2
- FWCI
- 0.52
- Type
- journal article
- Language
- en
- Open access
- diamond
- doi.org
- Licence
- Locations
- INOVTEK Polbeng - Seri Informatika (publishedVersion, cc-by-nc-sa)
- Topics
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- information security risk management, ISO 31000, penetration testing, higher education institutions, SQL injection, cross-site scripting, data breaches, vulnerability assessment, risk classification, security recommendations
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-11-07, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-11-07 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
