Analisis Keamanan Sistem Informasi Pada Website Extended E-Ianc Menggunakan Metode PTES, STRIDE, dan CVSS V4.0
Original Full-Text Article
Download published version for reading and archivingAbstract
The growing digitalization of healthcare increases reliance on web-based information systems, raising cybersecurity risks to sensitive patient data. Extended e-iANC, an expanded version of the Electronic Integrated Antenatal Care system now covering antenatal, delivery, postpartum, immunization, and family-planning services, had never undergone systematic security testing. This study evaluates the security level of Extended e-iANC against threats to data confidentiality, integrity, and availability using the Penetration Testing Execution Standard (PTES) across five phases, combined with STRIDE threat modeling and CVSS v4.0 risk scoring. Testing revealed ten vulnerabilities, two rated Critical; SQL Injection and Spring4Shell, two rated High; Path Traversal and Open Ports, and six rated Medium to Low. These results indicate substantial security gaps requiring immediate mitigation, particularly parameterized queries, framework updates, and network segmentation, to strengthen the system's resilience and regulatory compliance.
Author Biographies
Program Studi Manajemen Informasi Kesehatan, Fakultas Ilmu-Ilmu Kesehatan, Universitas Esa Unggul, Kota Jakarta Barat, Daerah Khusus Ibukota Jakarta, Indonesia.
Program Studi Manajemen Informasi Kesehatan, Fakultas Ilmu-Ilmu Kesehatan, Universitas Esa Unggul, Kota Jakarta Barat, Daerah Khusus Ibukota Jakarta, Indonesia.
Program Studi Manajemen Informasi Kesehatan, Fakultas Ilmu-Ilmu Kesehatan, Universitas Esa Unggul, Kota Jakarta Barat, Daerah Khusus Ibukota Jakarta, Indonesia.
Program Studi Manajemen Informasi Kesehatan, Fakultas Ilmu-Ilmu Kesehatan, Universitas Esa Unggul, Kota Jakarta Barat, Daerah Khusus Ibukota Jakarta, Indonesia.
How to Cite
This work is licensed under a Copyright (c) 2026 Ghefira Putri Nurraya, Imam Sutanto, Bambang Irawan, Hosizah Hosizah .
This is an open-access article distributed under the terms of the Creative Commons Attribution 4.0 International License .
- Share: You are free to copy, distribute, and transmit the work in any medium or format.
- Adapt: You are free to remix, transform, and build upon the work for any purpose, even commercially.
- Attribution: You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
References
Total: 15 References- Abdullayev, V., & Chauhan, A. S. (2023). SQL injection attack: Quick view. In Mesopotamian Journal of CyberSecurity (Vol. 2023, pp. 30–34). Mesopotamian Academic Press. https://doi.org/10.58496/MJCS/2023/006.
- Baligodugula, V. V., Ghimire, A., & Amsaad, F. (2024). An overview of secure network segmentation in connected IIoT environments. Computing & AI Connect, 1(1), 1. https://doi.org/10.69709/caic.2024.193182.
- Bunan Imtias, M., Umam, K., Mustofa, H., & Hadi Subowo, M. (2025). Comparative analysis of penetration testing frameworks: OWASP, PTES, and NIST SP 800-115 for detecting web application vulnerabilities. In Journal of Applied Informatics and Computing (JAIC) (Vol. 9, No. 6). https://doi.org/10.30871/jaic.v9i6.9846.
- Database, N. V. (2022). CVE-2022-22965 detail. In National Vulnerability Database (NVD). https://nvd.nist.gov/vuln/detail/cve-2022-22965.
- Disawal, S., & Suman, U. (2023). An approach to detect and prevent SQL injection and XSS vulnerability in the web application. International Journal of Engineering Trends and Technology, 71(8), 216–224. https://doi.org/10.14445/22315381/IJETT-V71I8P219.
Similar Articles
Articles sharing related keywords and machine learning classifications:
Most read articles by the same author(s)
Other papers published by author(s) in this journal: