Information System Security Analysis at RKSchool Depok Using Penetration Testing and Vulnerability Assessment Methods

Abstract

This study aims to evaluate the security level of the information system used by RKSchool, a micro-scale educational institution that relies on digital platforms for daily operations. The increasing number of cyberattacks targeting the education and MSME sectors highlights the need for systematic security assessments to minimize risks related to personal data exposure and service disruption. This research integrates penetration testing and vulnerability assessment based on the OWASP Web Security Testing Guide with perception analysis using the Technology Acceptance Model to examine organizational readiness in adopting the recommended security controls. The assessment was conducted through five main phases, including reconnaissance, scanning, exploitation, post-exploitation, and reporting. The findings indicate several vulnerabilities in server configuration, such as missing security headers, the absence of CSRF protection, and the lack of a Content Security Policy. TAM analysis shows that perceived usefulness and perceived ease of use have not yet formed a consistent behavioral intention toward security practices. The integration of both technical and behavioral findings demonstrates that the major risks do not solely originate from system weaknesses but also from limited organizational preparedness in implementing comprehensive security measures.