Strategi Keamanan Infrastruktur Web E-Commerce Berbasis OWASP Top 10: A Systematic Literature Review Menggunakan Analisis Matriks
Keywords:
E-Commerce, Keamanan Jaringan, OWASP Top 10, Defense-in-Depth, Systematic Literature Review, Vulnerability Assessment, Analisis MatriksAbstract
Perkembangan internet dan transaksi digital yang semakin pesat membawa dampak signifikan pada ekosistem e-commerce, namun di sisi lain terdapat peningkatan risiko serangan siber terhadap keamanan data sensitif pada infrastruktur jaringan web. Penelitian ini bertujuan untuk memetakan kerentanan dominan berbasis acuan Open Web Application Security Project (OWASP) Top 10, menganalisis efektivitas metode vulnerability assessment, serta merumuskan strategi security mitigation jaringan yang terstruktur. Metodologi yang digunakan berbasis pendekatan Systematic Literature Review (SLR) dengan mengikuti pedoman PRISMA. Artikel dievaluasi secara ketat menggunakan kriteria Quality Assessment (QA) biner (0/1) terhadap dataset final yang terdiri dari 15 artikel utama terpublikasi pada rentang tahun 2023 hingga 2026. Ekstraksi data kemudian diolah menggunakan analisis matriks biner (0/1) untuk mengukur persentase distribusi kerentanan, performa pemindaian, serta efektivitas mitigasi. Hasil sintesis menunjukkan bahwa kerentanan A03: Injection (SQLi/XSS) sebesar 86,7% dan A01: Broken Access Control sebesar 73,3% merupakan ancaman paling dominan pada platform e-commerce. Dari sisi pengujian, kombinasi teknik Dynamic Application Security Testing (DAST, 66,7%) dan Network Scanning (53,3%) terbukti paling efektif dalam mendeteksi celah keamanan sistem. Demikian, analisis matriks biner mengonfirmasi bahwa penerapan strategi pertahanan berlapis (defense-in-depth) yang mengintegrasikan Web Application Firewall (WAF, 100%), enkripsi TLS 1.3 (90,9%), serta 2FA/MFA dan IDS/IPS (72,7%) mampu menurunkan skor risiko CVSS hingga 85%. Dapat disimpulkan bahwa perlindungan infrastruktur web e-commerce membutuhkan integrasi mitigasi multi-layer secara terpadu dan berkelanjutan, bukan sekadar penanganan parsial.
Downloads
References
[1] F. P. E. Putra, U. Ubaidi, A. Zulfikri, G. Arifin, and R. M. Ilhamsyah, “Analysis of Phishing Attack Trends, Impacts and Prevention Methods: Literature Study,” Brill. Res. Artif. Intell., vol. 4, no. 1, pp. 413–421, 2024, doi: 10.47709/brilliance.v4i1.4357.
[2] S. Bumbungan, “Peran Dan Perkembangan Jaringan Internet Dalam Mendukung Transformasi Digital Global,” Bull. Netw. Eng. Informatics, vol. 3, no. 1, p. 11, 2025, doi: 10.59688/bufnets.v3i1.66.
[3] F. P. Eka Putra, Amir Hamzah, W. Agel, and R. O. Firmansyah Kusuma, “Impelementasi Sistem Keamanan Jaringan Mikrotik Menggunakan Firewall Filtering dan Port Knocking,” J. Sistim Inf. dan Teknol., vol. 5, no. 4, pp. 82–87, 2024, doi: 10.60083/jsisfotek.v5i4.329.
[4] A. Shafiyyah, G. F. Nama, and R. A. Pradipta, “Implementasi Wazuh Menggunakan Metode Ppdioo Di Sistem Keamanan Jaringan Psdku Universitas Lampung Waykanan Sebagai Deteksi Dan Respon Serangan Siber,” J. Inform. dan Tek. Elektro Terap., vol. 12, no. 2, 2024, doi: 10.23960/jitet.v12i2.4074.
[5] F. P. E. Putra, U. Ubaidi, A. Hamzah, W. A. Pramadi, and A. Nuraini, “Systematic Literature Review: Security Gap Detection On Websites Using Owasp Zap,” Brill. Res. Artif. Intell., vol. 4, no. 1, pp. 348–355, 2024, doi: 10.47709/brilliance.v4i1.4227.
[6] E. Septiawan and B. Irawan, “Implementasi Blockchain Dalam Sistem Keamanan Jaringan Untuk Mendeteksi Serangan Siber Distributed Denial of Service (Ddos),” JATI (Jurnal Mhs. Tek. Inform., vol. 10, no. 3, pp. 3804–3811, 2026, doi: 10.36040/jati.v10i3.18035.
[7] Fauzan Prasetyo Eka Putra, Debri Eko Arissandi, Achmad Rofiqi, and Moh Firman Hidayat, “Pemanfaatan Mikrotik Dalam Manajemen Bandwidth Pada Jaringan Sekolah,” J. Inform. Dan Tekonologi Komput., vol. 5, no. 1, pp. 93–101, 2025, doi: 10.55606/jitek.v5i1.5938.
[8] M. R. Reza Pahlevi, C. Umam, and L. B. Handoko, “Deteksi dan Pencegahan Web Defacing Judi Online dengan Wazuh SIEM dan Snort IDS Berbasis Signature,” J. Algoritm., vol. 22, no. 1, pp. 197–208, 2025, doi: 10.33364/algoritma/v.22-1.2220.
[9] L. Saroha, R. Octavianto, and E. S. S. Malays, “Pencegahan Dan Konsep IDS (Intrusion Detection System)Dalam Mendeteksi Serangan Siber Pada Sistem Keamanana DiUniversitas Persada Indonesia Y.A.i,” J. Ilm. Tek. Inform., vol. 25, no. 1, pp. 168–176, 2024, [Online]. Available: https://doi.org/10.37817/tekinfo.v25i1
[10] F. P. Eka Putra, L. Fitriyah, Z. Naimah, and S. A. Rofika, “Evaluasi Kinerja Aplikasi Wireshark Dalam Monitoring Jaringan Kecil Dengan Topologi Star dan Bus,” J. Ilm. Ilk. - Ilmu Komput. Inform., vol. 8, no. 2, pp. 164–176, 2025, doi: 10.47324/ilkominfo.v8i2.343.
[11] M. Y. S. Nacikit, M. Rahman, and A. E. Wardoyo, “Analisis Keamanan Aplikasi Berbasis Web Menggunakan Metode Penetration Testing (Studi kasus: E-Commerce As-Sakinah Mart),” INFORMATICS Educ. Prof. J. Informatics, vol. 10, no. 1, p. 25, 2025, doi: 10.51211/itbi.v10i1.3324.
[12] O. M. Olaniyi, O. O. Adebiyi, C. I. Ejoh, O. O. Afolabi, and V. O. Ejiofor, “Conversational AI-Powered Fraud Prevention in Augmented Reality E-Commerce: A Natural Language Processing Framework for Real-time Transaction Security,” 2026, researchgate.net. doi: 10.9734/ajrcos/2026/v19i1817.
[13] D. Lestari Lubis, F. Nisa, and A. Ulya, “Analisis Perbandingan Keamanan Aplikasi Web Pada Platform E-Commerce Studi Kasus: Shopee, Tiktok Shop Dan Facebook Marketplace Menggunakan Dynamic Application Security Testing (Dast),” JATI (Jurnal Mhs. Tek. Inform., vol. 9, no. 6, pp. 9240–9246, 2025, doi: 10.36040/jati.v9i6.15563.
[14] L. Kree, R. Helmke, and E. Winter, “Using semgrep oss to find owasp top 10 weaknesses in php applications: A case study,” … Conf. Detect. Intrusions, 2024, doi: 10.1007/978-3-031-64171-8_4.
[15] P. C. B. Naidu, R. Jayashree, and, “Comparison of SPV System Performance with DAST System Using MPPT Algorithms,” Int. Conf, 2024, doi: 10.1007/978-981-97-4152-6_36.
[16] J. M. Taylor, “Dimensionality and Item-Level Analysis of the DAST-10 in a Sample of HIV Patients with a History of Problematic Substance Use,” Meas. Eval. Couns, 2026, doi: 10.1080/07481756.2025.2585791.
[17] J. Abey, “Improving Security and Customer Trust in E-Commerce Using Modern Digital Technologies,” J. Internet Serv. Inf. Secur., vol. 16, no. 1, pp. 689–700, 2026, doi: 10.58346/JISIS.2026.I1.039.
[18] D. S. Islamey and J. Sutopo, “Designing a Two-Factor Authentication ( 2FA ) System in E-Commerce Applications,” vol. 6, no. 1, pp. 48– 55, 2025.
[19] F. P. E. Putra, R. W. Efendi, A. B. Tamam, and W. A. Pramadi, “Tren dan Praktik Terbaik dalam Pengembangan Web Berbasis API : Kajian Literatur terhadap Framework Laravel dan React,” Infomatek, vol. 27, no. 1, pp. 165–178, 2025, doi: 10.23969/infomatek.v27i1.25122.
[20] N. Mamuriyah, S. E. Prasetyo, and A. O. Sijabat, “Rancangan Sistem Keamanan Jaringan dari serangan DDoS Menggunakan Metode Pengujian Penetrasi,” J. Teknol. Dan Sist. Inf. Bisnis, vol. 6, no. 1, pp. 162–167, 2024, doi: 10.47233/jteksis.v6i1.1124.
[21] M. L. Arsalan and H. T. Sukmana, “Keamanan Jaringan Wi-Fi Terhadap Serangan Packet Sniffing Menggunakan Firewall Rule ( Studi
Kasus : Pt . Akurat . Co ) Wi-Fi Network Security Against Packet Sniffing Attacks Using Firewall Rule ( Case Study : Pt . Accurate . Co ),” CyberSecurity dan Forensik Digit., vol. 6, no. 2, pp. 30–38, 2023.
[22] M. V Herasymchuk, K. P. Melnykov, “DOS‐Like Strategy for the Spirocyclic MedChem Relevant Building Blocks via Petasis/Grubbs Reactions Sequence,” A Eur. J., 2025, doi: 10.1002/chem.202500681.
[23] P. Mamatha, S. Balaji, and S. S. Anuraghav, “Development of hybrid intrusion detection system leveraging ensemble stacked feature selectors and learning classifiers to mitigate the DoS attacks,” 2025, Springer. doi: 10.1007/s44196-025-00750-6.
[24] F. P. Eka Putra, F. Muslim, N. Hasanah, Holipah, R. Paradina, and R. Alim, “Analisis Komparasi Protokol Websocket dan MQTT Dalam Proses Push Notification,” J. Sistim Inf. dan Teknol., vol. 5, pp. 63–72, 2024, doi: 10.60083/jsisfotek.v5i4.325.
[25] E. Nurelasari and D. Gumilang Al Farabi, “Analisis Keamanan Sistem Website Menggunakan Metode Open Web Application Security Project (Owasp) Pada Simantep.Id,” JATI (Jurnal Mhs. Tek. Inform., vol. 8, no. 3, pp. 3049–3054, 2024, doi: 10.36040/jati.v8i3.9314.
[26] F. P. Eka Putra, . S., A. Ramadhani, and . M., “Integrasi Teknologi Kuantum dan fiber Optik untuk Meningkatkan Keamanan dan Efisiensi Jaringan Masa Depan,” J. Ilm. Ilk. - Ilmu Komput. Inform., vol. 8, no. 2, pp. 151–163, 2025, doi: 10.47324/ilkominfo.v8i2.342.
[27] Y. Dong, L. Zhang, and B. Cai, “Plasmon-enhanced second harmonic generation from DAST nanocrystals locally grown on a nanoporous gold substrate,” Nanotechnology, 2026, doi: 10.1088/1361-6528/ae4fc7.
[28] V. No, E. Juli, K. Jasa, S. Karya, and M. Utama, “ANALISIS SPACE MATRIX DAN QUANTITATIVE STRATEGIC PLANNING,” vol. 7, no. 2, pp. 536–552, 2026.
[29] F. P. E. Putra, K. Mufidah, R. M. Ilhamsyah, S. A. Efendy, and S. N. R. Barokah, “Tinjauan Performa RouterOS Mikrotik dalam Jaringan Internet: Analisis Kinerja dan Kelayakan,” Digit. Transform. Technol., vol. 3, no. 2, pp. 903–910, 2024, doi: 10.47709/digitech.v3i2.3446.
[30] B. Kumar et al., “Enhancing E-Commerce Security Based on Involution Function Using Twin Key AES Cipher,” IET Inf. Secur., vol. 2026, no. 1, 2026, doi: 10.1049/ise2/5710384.
[31] Harriansyah Harriansyah, Bayu Nurpatria, and Bagir Bagir, “Analisis Keamanan Sistem Informasi Berdasarkan COBIT 2019 pada Domain Deliver, Service, and Support (DSS) di Website Pojokoto.com,” SABER J. Tek. Inform. Sains dan Ilmu Komun., vol. 4, no. 3, pp. 46–56, 2026, doi: 10.59841/saber.v4i3.3860.
[32] Zumhur Alamin and Muhammad Amirul Mu’min, “Analisis Keamanan Jaringan pada Sistem Kendali Jarak Jauh untuk Infrastruktur Kritis,” J. Pengemb. Sains dan Teknol., vol. 1, no. 1, pp. 25–41, 2025, doi: 10.63866/jpst.v1i1.39.
[33] M. Alim, I. Rasyid Munthe, and A. Putra Juledi, “Evaluasi Keamanan Sistem Informasi dalam Lingkungan Bisnis Digital,” J. Ilmu Komput. dan Sist. Inf., vol. 7, no. 1, pp. 328–332, 2024, doi: 10.55338/jikomsi.v7i1.3088.
[34] A. Thool, J. Smith, and C. Brown, “SafeAIMerge: A Tool for Integrating DAST and LLM-Generated Security Feedback into GitHub Actions Workflows,” Proc. 2026 ACM Secur, 2026, doi: 10.1145/3805773.3806003.
[35] A. Gunawan H., Y. Sopian, Riyanto, E. Herdianto, and D. Saepurrahman, “Implementasi dan Analisis Sistem Keamanan Web pada PlanetElektronikIndonesia.com Menggunakan Teknologi SSL,” JTERA (Jurnal Teknol. Rekayasa), vol. 11, no. 1, pp. 139–148, 2026, doi:
10.31544/jtera.v11.i1.2026.139-148.
[36] A. P. D. Asiyanti and Agussalim Agussalim, “Strategi Manajemen Risiko dan Keamanan Siber dalam Ekonomi Digital: Tinjauan Literatur,” J. Penelit. Sist. Inf., vol. 2, no. 4, pp. 90–110, 2024, doi: 10.54066/jpsi.v2i4.2562.
[37] Sikri Adaya Mau and Y. K. Zega, “Kolaborasi Tim dalam Bidang Teknik Komputer dan Jaringan: Suatu Tinjauan Pustaka,” J. Ilm. Multidisiplin, vol. 3, no. 1, pp. 40–55, 2026, doi: 10.62282/juilmu.v3i1.40-55.
[38] Alfian Hongu Moly, Stefanus D.I. Mau, and Dian Fransiska Ledi, “Analisis Keamanan Jaringan Komputer Menggunakan Metode Penetration Testing,” Modem J. Inform. dan Sains Teknol., vol. 4, no. 1, pp. 10–22, 2025, doi: 10.62951/modem.v4i1.694.
[39] V. R. Vallu, W. Pulakhandam, and A. Kurunthachalam, “Revolutionizing Mobile Cloud Security: Employing Secure Multi-Party Computation and Blockchain Innovations for E-Commerce Platforms,” Int. Conf. Artif. Intell. Emerg. Technol. ICAIET 2025, 2025, doi: 10.1109/ICAIET65052.2025.11211015.
[40] F. P. E. Putra, S. A. A. Sugi, K. Mufidah, and Y. R. Febriani, “Analysis of Cyber Attacks on Network Security,” J. Inf. dan …, vol. 6, pp. 4–7, 2024, doi: 10.60083/jidt.v6i2.569.
[41] J. Pendidikan, “Edusaintek: Jurnal Pendidikan, Sains dan Teknologi,” vol. 10, no. 1, pp. 329–352, 2023.
[42] E. Haryanty, “Analisa Kompresi Citra Digital Menggunakan Metode Hadamard,” Teknika, vol. 1, no. 1, pp. 13–20, 2012, doi: 10.34148/teknika.v1i1.2.
[43] M. Nawrocki and J. Kołodziej, “Vulnerabilities of Web Applications: Good Practices and New Trends,” Appl. Cybersecurity Internet Gov., vol. 3, no. 2, pp. 122–143, 2024, doi: 10.60097/ACIG/199521.
[44] A. R. Supriyatna, I. Asrowardi, S. D. Putra, and E. Subyantoro, “Analisis Kerentanan Aplikasi Web E-commerce Berdasarkan Standar OWASP Top 10: Studi Kasus pada Situs Kopi Lampung Nusantara,” Expert J. Manaj. Sist. Inf. dan Teknol., vol. 14, no. 2, p. 95, 2024, doi: 10.36448/expert.v14i2.4034.
[45] R. Pachlor, R. Mohanraj, K. Sharada, S. Sachi, K. Neelima, and P. Ramadevi, “Securing the Digital Commerce Spectrum and Cyber Security Strategies for Web, E-commerce, M-commerce, and E-mail Security,” 2024, academia.edu. doi: 10.54216/JCIM.140103.
[46] P. K. Udayaprasad, J. Shreyas, F. Flammini, and H. Lin, “Cyber Security Issues, Challenges in E-Shopping/E-Commerce,” Cyber Secur. Bus. Anal., pp. 23–45, 2025, doi: 10.1201/9781003540045-3.
[47] Y. Yu, “Computer Network Privacy Security Technology Based on Cloud Computing,” 2024 5th Int. Conf. Emerg. Technol. INCET 2024, 2024, doi: 10.1109/INCET61516.2024.10593132.
[48] H. Huang, “Effective Application of Computer Network Security Technology in E-commerce Operation and Maintenance,” 2024. doi: 10.22158/jepf.v10n3p17.
[49] M. Al-Laham, F. Omar, and Z. A. Alqadi, “Image Binary Matrix Processing to Encrypt-Decrypt Digital Images,” Int. J. Adv. Comput. Sci. Appl., vol. 15, no. 3, pp. 1229–1238, 2024, doi: 10.14569/IJACSA.2024.01503121.
[50] M. H. Najajra, A. V. Bolgak, E. I. Vatutin, and I. F. Amer, “A Specialised Computing Device for Multiplying Square Binary Matrices Based on Multiport Parallel-Pipelined Memory,” Tikrit J. Eng. Sci., vol. 32, no. SP1, 2025, doi: 10.25130/tjes.sp1.2025.44.
[51] D. Desantis, E. Skau, D. P. Truong, and B. Alexandrov, “Factorization of Binary Matrices: Rank Relations, Uniqueness and Model Selection of Boolean Decomposition,” ACM Trans. Knowl. Discov. Data, vol. 16, no. 6, 2022, doi: 10.1145/3522594.
Published
Issue
Section
License
Copyright (c) 2026 Fara Amelia Ekaputri Oktavia, M.Afredo Dwi Setiawan, Naila Indriani Kartika Sari (Penulis)
This work is licensed under a Creative Commons Attribution 4.0 International License.
