Analisis Risiko Keamanan Siber Website Peken Surabaya Menggunakan Standar ISO 27005:2019 dan OWASP ZAP

The rapid growth of information technology has driven digital transformation in various sectors, including micro, small, and medium enterprises (MSMEs), the backbone of the Indonesian economy. In response to the challenges and opportunities of digitalization, the Surabaya City Government launched the Peken e-commerce platform on October 31, 2021. This platform aims to help MSMEs market their products online, expand market reach, and increase competitiveness. However, the use of digital systems also presents new challenges, particularly in terms of cybersecurity. Dependence on technology opens the door to various threats that can compromise data confidentiality, integrity, and availability. This study aims to analyze and evaluate information security risks on the Peken Surabaya website using a risk management approach based on the ISO/IEC 27005:2019 standard. The analysis method involves identifying information assets, recognizing potential threats, identifying vulnerabilities, and assessing risk levels based on the likelihood of occurrence and impact. To support the analysis, technical testing was also conducted using the Open Web Application Security Project Zed Attack Proxy (OWASP ZAP) tool. The research results indicate that most of the risks faced by Peken Surabaya are moderate to very high. These risks include Distributed Denial of Service (DDoS) attacks, user data leaks, and the lack of a two-factor authentication (2FA) system. Based on these findings, a risk management strategy was developed using the Risk Modification, Risk Sharing, Risk Retention, and Risk Avoidance approaches. Furthermore, this study recommends security controls based on ISO/IEC 27005 and OWASP Top 10 to enhance system protection. These findings emphasize the importance of implementing international standards-based risk management in maintaining the continuity and security of digital public services, particularly those supporting the MSME sector in the digital era.