ANALISIS KEAMANAN WEBSITE SISTEM KEUANGAN PADA PUSAT KEGIATAN BELAJAR MASYARAKAT AL FURQON MENGGUNAKAN METODE VULNERABILITY ASSESSMENT

ABSTRAK
Keamanan website merupakan aspek penting dalam melindungi informasi, khususnya pada sistem yang mengelola data keuangan. Penelitian ini bertujuan menganalisis keamanan Website Sistem Keuangan PKBM Al Furqon Bobotsari menggunakan metode Vulnerability Assessment. Pengujian dilakukan melalui tahapan Information Gathering menggunakan Dig, IPinfo, dan Nmap, Vulnerability Scanning menggunakan OWASP ZAP, Vulnerability Analysis, Risk Assessment menggunakan CVSS versi 3.1, serta Recommendation and Reporting. Hasil penelitian menunjukkan 14 jenis temuan kerentanan, terdiri atas 5 temuan tingkat Medium dan 9 temuan tingkat Low. Temuan Medium meliputi Absence of Anti-CSRF Tokens, Content Security Policy Header Not Set, Anti-clickjacking Header Missing, Sub Resource Integrity Attribute Missing, dan Vulnerable JavaScript Library. Rekomendasi mitigasi meliputi penerapan anti-CSRF token, security header, pengamanan cookie, pembaruan library JavaScript, serta penerapan HSTS dan X-Content-Type-Options. Hasil penelitian dapat menjadi dasar bagi pengelola dalam meningkatkan keamanan Website Sistem Keuangan PKBM Al Furqon Bobotsari.
Kata kunci: keamanan website, Vulnerability Assessment, OWASP ZAP, CVSS, kerentanan.

ABSTRACT
Website security is an important aspect of protecting information, particularly in systems that manage financial data. This study aims to analyze the security of the Financial System Website of PKBM Al Furqon Bobotsari using the Vulnerability Assessment method. The assessment consisted of Information Gathering using Dig, IPinfo, and Nmap, Vulnerability Scanning using OWASP ZAP, Vulnerability Analysis, Risk Assessment using CVSS version 3.1, and Recommendation and Reporting. The results identified 14 types of vulnerabilities, consisting of 5 Medium-level and 9 Low-level findings. The Medium-level findings included Absence of Anti-CSRF Tokens, Content Security Policy Header Not Set, Anti-clickjacking Header Missing, Sub Resource Integrity Attribute Missing, and Vulnerable JavaScript Library. The recommended mitigations include implementing anti-CSRF tokens and security headers, securing cookies, updating JavaScript libraries, and implementing HSTS and X-Content-Type-Options. The results of this study can serve as a basis for improving the security of the Financial System Website of PKBM Al Furqon Bobotsari.
Keywords: website security, Vulnerability Assessment, OWASP ZAP, CVSS, vulnerabilities.