Security Evaluation of Insurance Portal Agency Information System Based on ISO/IEC 25010 Quality Standard Utilizing OWASP ZAP

Information System, like insurance agency portals, bring substantial benefits for user and the company but also pose security risks due to the sensitive data they handle. Addressing these risks through regular security evaluations and enhancements is crucial to prevent potential financial, reputational, and legal consequences. This research focuses on security measurement in two versions of the agency portal: the old and the new. Both serving the same purpose but differing in technology and infrastructure. Employing the ISO 25010 security standard, tools like OWASP ZAP are used alongside manual testing to assess each ISO 25010 characteristic and subsequently evaluate both portals. The objective is to suggest security enhancements and draw comparisons between the two. The testing of ISO 25010 is segmented into several phases: identifying security characteristics, establishing measurements, assessing security on two application portals, conducting evaluations and comparisons, and providing recommendations. Testing revealed that the older portal outperforms the newer version in confidentiality and integrity, despite the latter's advanced technology. However, the new portal excels in authentication, and both applications demonstrate high scores in accountability. Both portals need to enhance the non-repudiation characteristic, given the absence of digital signatures. Based on the analysis, additional recommendations are made to improve the security of both applications.