{"id":15356,"date":"2026-09-26T22:14:30","date_gmt":"2026-09-27T03:14:30","guid":{"rendered":"https:\/\/urbadigital.com\/?p=15356"},"modified":"2026-09-26T22:15:38","modified_gmt":"2026-09-27T03:15:38","slug":"web-security-in-the-ecuadorian-public-sector-one-month-of-analysis-four-sectors-fifty-institutions","status":"publish","type":"post","link":"https:\/\/urbadigital.com\/es\/blog\/web-security-in-the-ecuadorian-public-sector-one-month-of-analysis-four-sectors-fifty-institutions\/","title":{"rendered":"Seguridad Web en el Sector P\u00fablico Ecuatoriano: Un Mes de An\u00e1lisis, Cuatro Sectores, Cincuenta Instituciones"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"15356\" class=\"elementor elementor-15356\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-09262a2 e-flex e-con-boxed e-con e-parent\" data-id=\"09262a2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7f8b28f elementor-widget elementor-widget-html\" data-id=\"7f8b28f\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"html.default\">\n\t\t\t\t\t<link rel=\"preconnect\" href=\"https:\/\/fonts.googleapis.com\">\r\n<link rel=\"preconnect\" href=\"https:\/\/fonts.gstatic.com\" crossorigin>\r\n<link href=\"https:\/\/fonts.googleapis.com\/css2?family=Rubik:wght@300;400;500;600;700&family=Inter:wght@300;400;500;600;700&family=Nunito:wght@300;400;500;600;700&family=Raleway:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap\" rel=\"stylesheet\">\r\n<style>\r\n\r\n  .blog-sector-pub {\r\n    background: transparent;\r\n    color: #FFFFFF;\r\n    font-family: 'Nunito', -apple-system, sans-serif;\r\n    font-weight: 400;\r\n    line-height: 1.8;\r\n    -webkit-font-smoothing: antialiased;\r\n    overflow-x: hidden;\r\n  }\r\n\r\n  .blog-sector-pub {\r\n    --bg: #0F0F1E;\r\n    --bg-elev: #16162F;\r\n    --bg-card: #1D1D3E;\r\n    --border: rgba(255, 255, 255, 0.08);\r\n    --border-strong: rgba(255, 255, 255, 0.14);\r\n    --text: #FFFFFF;\r\n    --text-muted: #C0C0C0;\r\n    --text-dim: #858599;\r\n    --good: #4ADE80;\r\n    --good-bg: rgba(74, 222, 128, 0.12);\r\n    --warn: #FBB040;\r\n    --warn-bg: rgba(251, 176, 64, 0.12);\r\n    --bad: #F87171;\r\n    --bad-bg: rgba(248, 113, 113, 0.12);\r\n    --accent: #FBB040;\r\n    --accent-soft: rgba(251, 176, 64, 0.15);\r\n    --info: #60A5FA;\r\n  }\r\n\r\n  .blog-sector-pub *, .blog-sector-pub *::before, .blog-sector-pub *::after {\r\n    box-sizing: border-box;\r\n    margin: 0;\r\n    padding: 0;\r\n  }\r\n\r\n  .blog-sector-pub .wrap {\r\n    max-width: 800px;\r\n    margin: 0 auto;\r\n    padding: 0 24px;\r\n  }\r\n\r\n  \/* \u2500\u2500 NAV \u2500\u2500 *\/\r\n  .blog-sector-pub .nav {\r\n    position: sticky; top: 0; z-index: 100;\r\n    background: rgba(15, 15, 30, 0.85);\r\n    backdrop-filter: blur(20px);\r\n    -webkit-backdrop-filter: blur(20px);\r\n    border-bottom: 1px solid var(--border);\r\n  }\r\n  .blog-sector-pub .nav-inner {\r\n    display: flex; align-items: center; justify-content: space-between;\r\n    max-width: 800px; margin: 0 auto; padding: 18px 24px;\r\n  }\r\n  .blog-sector-pub .nav-brand {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 18px; font-weight: 500;\r\n    letter-spacing: -0.01em;\r\n    text-decoration: none;\r\n    color: var(--text);\r\n  }\r\n  .blog-sector-pub .nav-brand span { color: var(--accent); }\r\n  .blog-sector-pub .nav-meta {\r\n    font-family: 'Inter', sans-serif;\r\n    font-size: 15px; font-weight: 400;\r\n    color: #ECECEC;\r\n    letter-spacing: 0.9px;\r\n    text-transform: uppercase;\r\n  }\r\n\r\n  \/* \u2500\u2500 HEADER \u2500\u2500 *\/\r\n  .blog-sector-pub .blog-header {\r\n    padding: 70px 0 45px;\r\n    border-bottom: 1px solid var(--border);\r\n  }\r\n  .blog-sector-pub .eyebrow {\r\n    font-family: 'Raleway', sans-serif;\r\n    font-size: 11px; font-weight: 700;\r\n    letter-spacing: 0.2em;\r\n    text-transform: uppercase;\r\n    color: var(--accent);\r\n    margin-bottom: 18px;\r\n    display: inline-block;\r\n  }\r\n  .blog-sector-pub .blog-title {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: clamp(30px, 5vw, 46px);\r\n    font-weight: 500;\r\n    line-height: 1.22;\r\n    letter-spacing: -0.02em;\r\n    color: var(--text);\r\n    margin-bottom: 24px;\r\n  }\r\n  .blog-sector-pub .blog-meta-bar {\r\n    display: flex; flex-wrap: wrap; gap: 16px;\r\n    font-family: 'Inter', sans-serif;\r\n    font-size: 13px; color: var(--text-dim);\r\n    align-items: center; margin-top: 24px;\r\n  }\r\n  .blog-sector-pub .blog-meta-bar span { display: inline-flex; align-items: center; gap: 6px; }\r\n  .blog-sector-pub .blog-meta-bar .author { color: var(--text-muted); font-weight: 500; }\r\n  .blog-sector-pub .blog-meta-bar .separator { color: var(--border-strong); }\r\n\r\n  \/* \u2500\u2500 SCORE BAND \u2500\u2500 *\/\r\n  .blog-sector-pub .score-band {\r\n    background: rgba(22, 22, 47, 0.7);\r\n    border-bottom: 1px solid var(--border);\r\n    margin-bottom: 0;\r\n  }\r\n  .blog-sector-pub .score-band-inner {\r\n    max-width: 800px; margin: 0 auto; padding: 0 24px;\r\n    display: grid; grid-template-columns: repeat(4, 1fr);\r\n  }\r\n  .blog-sector-pub .sbi {\r\n    padding: 22px 16px;\r\n    border-right: 1px solid var(--border);\r\n    text-align: center;\r\n  }\r\n  .blog-sector-pub .sbi:last-child { border-right: none; }\r\n  .blog-sector-pub .sbi-n {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 2.2rem; font-weight: 700;\r\n    color: var(--bad); line-height: 1;\r\n    margin-bottom: 6px; letter-spacing: -0.03em;\r\n  }\r\n  .blog-sector-pub .sbi-n.ok { color: var(--good); }\r\n  .blog-sector-pub .sbi-n.warn { color: var(--warn); }\r\n  .blog-sector-pub .sbi-l {\r\n    font-family: 'Inter', sans-serif;\r\n    font-size: 11px; color: var(--text-dim); line-height: 1.4;\r\n  }\r\n\r\n  \/* \u2500\u2500 BODY \u2500\u2500 *\/\r\n  .blog-sector-pub .blog-content {\r\n    padding: 56px 0;\r\n    font-size: 18px;\r\n  }\r\n  .blog-sector-pub .blog-content p {\r\n    margin-bottom: 26px;\r\n    color: var(--text-muted);\r\n  }\r\n  .blog-sector-pub .blog-content strong { color: var(--text); font-weight: 600; }\r\n  .blog-sector-pub .blog-content h2 {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 30px; font-weight: 500;\r\n    margin: 52px 0 24px;\r\n    color: var(--text); letter-spacing: -0.018em; line-height: 1.3;\r\n  }\r\n  .blog-sector-pub .blog-content h2::after {\r\n    content: '';\r\n    display: block; width: 45px; height: 3px;\r\n    background: var(--accent); margin-top: 10px; border-radius: 2px;\r\n  }\r\n  .blog-sector-pub .blog-content h3 {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 21px; font-weight: 500;\r\n    margin: 36px 0 16px; color: var(--text);\r\n  }\r\n  .blog-sector-pub .blog-content hr {\r\n    border: none; border-top: 1px solid var(--border); margin: 44px 0;\r\n  }\r\n  .blog-sector-pub .blog-content code {\r\n    font-family: 'JetBrains Mono', monospace;\r\n    background: rgba(30, 42, 58, 0.8);\r\n    color: var(--accent); padding: 2px 7px;\r\n    border-radius: 4px; font-size: 0.84em;\r\n  }\r\n\r\n  \/* \u2500\u2500 NOTE BOX \u2500\u2500 *\/\r\n  .blog-sector-pub .note-box {\r\n    background: var(--bg-elev);\r\n    border: 1px solid var(--border);\r\n    border-radius: 12px;\r\n    padding: 22px 26px;\r\n    margin: 32px 0;\r\n    font-size: 16px;\r\n    color: var(--text-muted);\r\n    line-height: 1.72;\r\n  }\r\n  .blog-sector-pub .note-box strong { color: var(--text); }\r\n\r\n  \/* \u2500\u2500 SECTOR GRID \u2500\u2500 *\/\r\n  .blog-sector-pub .sector-grid {\r\n    display: grid; grid-template-columns: 1fr 1fr;\r\n    gap: 12px; margin: 32px 0;\r\n  }\r\n  .blog-sector-pub .sec-card {\r\n    background: var(--bg-card);\r\n    border: 1px solid var(--border);\r\n    border-radius: 12px;\r\n    padding: 20px 22px;\r\n    transition: border-color 0.2s;\r\n  }\r\n  .blog-sector-pub .sec-card:hover { border-color: var(--border-strong); }\r\n  .blog-sector-pub .sec-week {\r\n    font-family: 'JetBrains Mono', monospace;\r\n    font-size: 10px; font-weight: 500;\r\n    color: var(--text-dim); letter-spacing: 0.08em;\r\n    text-transform: uppercase; margin-bottom: 4px;\r\n  }\r\n  .blog-sector-pub .sec-name {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 15px; font-weight: 600;\r\n    color: var(--text); margin-bottom: 6px;\r\n  }\r\n  .blog-sector-pub .sec-count {\r\n    font-size: 12px; color: var(--text-dim); line-height: 1.5; margin-bottom: 14px;\r\n  }\r\n  .blog-sector-pub .sec-score { display: flex; align-items: baseline; gap: 6px; }\r\n  .blog-sector-pub .sec-n {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 2rem; font-weight: 700; line-height: 1; letter-spacing: -0.02em;\r\n  }\r\n  .blog-sector-pub .sec-n.bad { color: var(--bad); }\r\n  .blog-sector-pub .sec-n.warn { color: var(--warn); }\r\n  .blog-sector-pub .sec-slash { font-size: 13px; color: var(--text-dim); }\r\n  .blog-sector-pub .grade-badge {\r\n    display: inline-flex; align-items: center; justify-content: center;\r\n    width: 22px; height: 22px; border-radius: 5px;\r\n    font-family: 'JetBrains Mono', monospace;\r\n    font-weight: 700; font-size: 11px; margin-left: 4px;\r\n  }\r\n  .blog-sector-pub .gb-F { background: rgba(248,113,113,.12); color: var(--bad); border: 1px solid rgba(248,113,113,.25); }\r\n  .blog-sector-pub .gb-C { background: rgba(251,176,64,.12); color: var(--warn); border: 1px solid rgba(251,176,64,.25); }\r\n\r\n  \/* \u2500\u2500 CHART \u2500\u2500 *\/\r\n  .blog-sector-pub .infographic-wrapper {\r\n    background: var(--bg-elev);\r\n    border: 1px solid var(--border);\r\n    border-radius: 16px;\r\n    padding: 30px;\r\n    margin: 44px 0;\r\n  }\r\n  .blog-sector-pub .infographic-title {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 17px; font-weight: 500;\r\n    color: var(--text); margin-bottom: 8px;\r\n    letter-spacing: -0.01em;\r\n  }\r\n  .blog-sector-pub .infographic-sub {\r\n    font-family: 'Inter', sans-serif;\r\n    font-size: 12px; color: var(--text-dim); margin-bottom: 24px;\r\n  }\r\n  .blog-sector-pub .chart-grp {\r\n    font-family: 'JetBrains Mono', monospace;\r\n    font-size: 10px; font-weight: 700;\r\n    color: var(--text-dim); letter-spacing: 0.1em;\r\n    text-transform: uppercase; margin: 18px 0 10px;\r\n    display: flex; align-items: center; gap: 10px;\r\n  }\r\n  .blog-sector-pub .chart-grp:first-of-type { margin-top: 0; }\r\n  .blog-sector-pub .chart-grp::after {\r\n    content: ''; flex: 1; height: 1px; background: var(--border);\r\n  }\r\n  .blog-sector-pub .chart-row {\r\n    display: grid;\r\n    grid-template-columns: 190px 1fr 38px;\r\n    align-items: center; gap: 12px; margin-bottom: 6px;\r\n  }\r\n  .blog-sector-pub .chart-row:last-child { margin-bottom: 0; }\r\n  .blog-sector-pub .chart-label {\r\n    font-family: 'Inter', sans-serif;\r\n    font-size: 11px; color: var(--text-dim);\r\n    text-align: right; line-height: 1.35;\r\n    white-space: nowrap; overflow: hidden; text-overflow: ellipsis;\r\n  }\r\n  .blog-sector-pub .chart-bar-track {\r\n    background: rgba(0,0,0,.35);\r\n    height: 18px; border-radius: 4px;\r\n    position: relative; overflow: hidden;\r\n    border: 1px solid var(--border);\r\n  }\r\n  .blog-sector-pub .chart-bar-fill { height: 100%; border-radius: 3px; }\r\n  .blog-sector-pub .bf-F { background: #b84040; }\r\n  .blog-sector-pub .bf-D { background: #a06820; }\r\n  .blog-sector-pub .bf-C { background: #8a7810; }\r\n  .blog-sector-pub .bf-B { background: #2a8a56; }\r\n  .blog-sector-pub .chart-val {\r\n    font-family: 'JetBrains Mono', monospace;\r\n    font-size: 11px; font-weight: 700; text-align: right;\r\n  }\r\n  .blog-sector-pub .vF { color: var(--bad); }\r\n  .blog-sector-pub .vD { color: #c8882a; }\r\n  .blog-sector-pub .vC { color: var(--warn); }\r\n  .blog-sector-pub .vB { color: var(--good); }\r\n  .blog-sector-pub .chart-legend {\r\n    display: flex; gap: 14px; flex-wrap: wrap;\r\n    margin-top: 22px; padding-top: 18px;\r\n    border-top: 1px solid var(--border);\r\n  }\r\n  .blog-sector-pub .cl-item {\r\n    display: flex; align-items: center; gap: 6px;\r\n    font-family: 'Inter', sans-serif;\r\n    font-size: 11px; color: var(--text-dim);\r\n  }\r\n  .blog-sector-pub .cl-item:last-child { margin-left: auto; }\r\n  .blog-sector-pub .cl-dot {\r\n    width: 9px; height: 9px; border-radius: 2px; flex-shrink: 0;\r\n  }\r\n\r\n  \/* \u2500\u2500 STAT CARDS \u2500\u2500 *\/\r\n  .blog-sector-pub .stat-grid {\r\n    display: flex; flex-direction: column; gap: 10px; margin: 28px 0;\r\n  }\r\n  .blog-sector-pub .stat-card {\r\n    background: var(--bg-card);\r\n    border: 1px solid var(--border);\r\n    border-radius: 12px;\r\n    padding: 20px 22px;\r\n  }\r\n  .blog-sector-pub .sc-name {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 14px; font-weight: 600;\r\n    color: var(--text); margin-bottom: 6px;\r\n  }\r\n  .blog-sector-pub .sc-n {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 2rem; font-weight: 700;\r\n    color: var(--bad); line-height: 1.1;\r\n    margin-bottom: 8px; letter-spacing: -0.02em;\r\n  }\r\n  .blog-sector-pub .sc-n.warn { color: var(--warn); }\r\n  .blog-sector-pub .sc-desc {\r\n    font-family: 'Inter', sans-serif;\r\n    font-size: 14px; color: var(--text-dim); line-height: 1.65;\r\n  }\r\n\r\n  \/* \u2500\u2500 EXCEPTIONS (los que pasaron) \u2500\u2500 *\/\r\n  .blog-sector-pub .exc-list { display: flex; flex-direction: column; gap: 10px; margin: 28px 0; }\r\n  .blog-sector-pub .exc {\r\n    background: var(--bg-card);\r\n    border: 1px solid rgba(74,222,128,.15);\r\n    border-left: 3px solid var(--good);\r\n    border-radius: 0 12px 12px 0;\r\n    padding: 18px 20px; display: flex; align-items: flex-start; gap: 18px;\r\n    transition: border-color 0.2s;\r\n  }\r\n  .blog-sector-pub .exc:hover { border-color: rgba(74,222,128,.3); }\r\n  .blog-sector-pub .exc-score {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 2rem; font-weight: 700;\r\n    color: var(--good); line-height: 1; flex-shrink: 0;\r\n    letter-spacing: -0.02em;\r\n  }\r\n  .blog-sector-pub .exc-name {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 14px; font-weight: 600;\r\n    color: var(--text); margin-bottom: 4px;\r\n  }\r\n  .blog-sector-pub .exc-why {\r\n    font-family: 'Inter', sans-serif;\r\n    font-size: 13px; color: var(--text-dim); line-height: 1.55;\r\n  }\r\n\r\n  \/* \u2500\u2500 PULL QUOTE \u2500\u2500 *\/\r\n  .blog-sector-pub .pull-quote {\r\n    background: var(--bg-elev);\r\n    border-left: 3px solid var(--accent);\r\n    border-radius: 0 12px 12px 0;\r\n    padding: 20px 26px; margin: 36px 0;\r\n  }\r\n  .blog-sector-pub .pull-quote p {\r\n    margin: 0; font-size: 17px;\r\n    font-style: italic; color: var(--text); line-height: 1.7;\r\n  }\r\n\r\n  \/* \u2500\u2500 LEGAL CALLOUT \u2500\u2500 *\/\r\n  .blog-sector-pub .legal-callout {\r\n    background: var(--bg-elev);\r\n    border-left: 4px solid var(--info);\r\n    border-radius: 0 12px 12px 0;\r\n    padding: 26px 30px; margin: 36px 0;\r\n    border-top: 1px solid var(--border);\r\n    border-right: 1px solid var(--border);\r\n    border-bottom: 1px solid var(--border);\r\n  }\r\n  .blog-sector-pub .legal-callout.warning { border-left-color: var(--warn); }\r\n  .blog-sector-pub .legal-callout.danger { border-left-color: var(--bad); }\r\n  .blog-sector-pub .legal-callout-title {\r\n    font-family: 'JetBrains Mono', monospace;\r\n    font-size: 12px; font-weight: 500;\r\n    letter-spacing: 0.12em; text-transform: uppercase;\r\n    color: var(--info); margin-bottom: 12px;\r\n  }\r\n  .blog-sector-pub .legal-callout.warning .legal-callout-title { color: var(--warn); }\r\n  .blog-sector-pub .legal-callout.danger .legal-callout-title { color: var(--bad); }\r\n  .blog-sector-pub .legal-callout h3 {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-size: 19px; font-weight: 500;\r\n    margin: 0 0 10px; color: var(--text);\r\n  }\r\n  .blog-sector-pub .legal-callout p {\r\n    margin-bottom: 10px; font-size: 16px; line-height: 1.7;\r\n  }\r\n  .blog-sector-pub .legal-callout p:last-child { margin-bottom: 0; }\r\n\r\n  \/* \u2500\u2500 FINDINGS \u2500\u2500 *\/\r\n  .blog-sector-pub .findings { display: flex; flex-direction: column; gap: 10px; margin: 28px 0; }\r\n  .blog-sector-pub .finding {\r\n    background: var(--bg-card);\r\n    border-left: 3px solid;\r\n    border-radius: 0 12px 12px 0;\r\n    padding: 16px 20px; font-size: 16px;\r\n    color: var(--text-muted); line-height: 1.72;\r\n  }\r\n  .blog-sector-pub .f-red { border-color: var(--bad); }\r\n  .blog-sector-pub .f-warn { border-color: #c8882a; }\r\n  .blog-sector-pub .f-gold { border-color: var(--accent); }\r\n  .blog-sector-pub .f-green { border-color: var(--good); }\r\n\r\n  \/* \u2500\u2500 METHOD BOX \u2500\u2500 *\/\r\n  .blog-sector-pub .method-box {\r\n    background: var(--bg-elev);\r\n    border: 1px solid var(--border);\r\n    border-radius: 12px; padding: 22px 26px;\r\n    margin: 32px 0; font-size: 15px;\r\n    color: var(--text-muted); line-height: 1.75;\r\n  }\r\n  .blog-sector-pub .method-box strong { color: var(--text); }\r\n\r\n  \/* \u2500\u2500 CTA \u2500\u2500 *\/\r\n  .blog-sector-pub .cta-box {\r\n    background: linear-gradient(135deg, rgba(22, 22, 47, 0.6), rgba(251, 176, 64, 0.03));\r\n    border: 1px solid rgba(251, 176, 64, 0.25);\r\n    border-top: 2px solid var(--accent);\r\n    border-radius: 12px; padding: 32px 32px 28px;\r\n    margin: 44px 0 0;\r\n    transition: all 0.3s ease;\r\n  }\r\n  .blog-sector-pub .cta-box:hover {\r\n    border-color: rgba(251, 176, 64, 0.4);\r\n    transform: translateY(-2px);\r\n    box-shadow: 0 12px 30px rgba(0,0,0,.2);\r\n  }\r\n  .blog-sector-pub .cta-eyebrow {\r\n    font-family: 'Raleway', sans-serif;\r\n    font-size: 11px; font-weight: 700;\r\n    color: var(--accent); letter-spacing: 0.15em;\r\n    text-transform: uppercase; margin-bottom: 12px;\r\n  }\r\n  .blog-sector-pub .cta-box h2 {\r\n    font-size: 26px; margin: 0 0 14px; padding-bottom: 0;\r\n  }\r\n  .blog-sector-pub .cta-box h2::after { display: none; }\r\n  .blog-sector-pub .cta-box p { font-size: 16px; margin-bottom: 20px; }\r\n  .blog-sector-pub .cta-btn {\r\n    display: inline-block; background: var(--accent); color: #000;\r\n    font-family: 'Rubik', sans-serif;\r\n    font-weight: 600; font-size: 14px;\r\n    padding: 12px 28px; border-radius: 8px;\r\n    text-decoration: none; letter-spacing: -0.01em;\r\n    transition: opacity 0.2s;\r\n  }\r\n  .blog-sector-pub .cta-btn:hover { opacity: 0.88; }\r\n\r\n  \/* \u2500\u2500 ARTICLE FOOTER \u2500\u2500 *\/\r\n  .blog-sector-pub .art-foot {\r\n    padding: 28px 0; border-top: 1px solid var(--border);\r\n    display: flex; align-items: flex-start; gap: 16px;\r\n    flex-wrap: wrap; margin-top: 28px;\r\n  }\r\n  .blog-sector-pub .af-name {\r\n    font-family: 'Rubik', sans-serif;\r\n    font-weight: 600; font-size: 14px; color: var(--text);\r\n  }\r\n  .blog-sector-pub .af-role {\r\n    font-family: 'Inter', sans-serif;\r\n    font-size: 13px; color: var(--text-dim); margin-top: 2px;\r\n  }\r\n  .blog-sector-pub .af-tags {\r\n    display: flex; gap: 7px; flex-wrap: wrap; padding-top: 2px;\r\n  }\r\n  .blog-sector-pub .ftag {\r\n    font-family: 'Inter', sans-serif;\r\n    font-size: 12px; border: 1px solid var(--border);\r\n    color: var(--text-dim); padding: 4px 12px; border-radius: 20px;\r\n  }\r\n\r\n  \/* \u2500\u2500 RESPONSIVE \u2500\u2500 *\/\r\n  @media (max-width: 680px) {\r\n    .blog-sector-pub .score-band-inner { grid-template-columns: repeat(2, 1fr); }\r\n    .blog-sector-pub .sbi:nth-child(2) { border-right: none; }\r\n    .blog-sector-pub .sector-grid { grid-template-columns: 1fr; }\r\n    .blog-sector-pub .chart-row { grid-template-columns: 110px 1fr 32px; gap: 8px; }\r\n    .blog-sector-pub .chart-label { font-size: 10px; }\r\n    .blog-sector-pub .blog-title { font-size: 28px; }\r\n    .blog-sector-pub .blog-content h2 { font-size: 24px; margin-top: 40px; }\r\n    .blog-sector-pub .cta-box { padding: 22px 20px; }\r\n  }\r\n\r\n<\/style>\r\n\r\n<div class=\"blog-sector-pub\">\r\n\r\n\r\n  <header class=\"blog-header\">\r\n    <div class=\"wrap\">\r\n      <div class=\"eyebrow\">Consolidated Research \u00b7 HTTP Observatory \u00b7 September 2026<\/div>\r\n      <h1 class=\"blog-title\">Web Security in the Ecuadorian Public Sector: One Month of Analysis, Four Sectors, Fifty Institutions<\/h1>\r\n      <div class=\"blog-meta-bar\">\r\n        <span class=\"author\">By URBADIGITAL SA<\/span>\r\n        <span class=\"separator\">\u00b7<\/span>\r\n        <span>WebPerformance Report<\/span>\r\n        <span class=\"separator\">\u00b7<\/span>\r\n        <span>September 29, 2026<\/span>\r\n        <span class=\"separator\">\u00b7<\/span>\r\n        <span>6 min read<\/span>\r\n      <\/div>\r\n    <\/div>\r\n  <\/header>\r\n\r\n  <!-- SCORE BAND -->\r\n  <div class=\"score-band\">\r\n    <div class=\"score-band-inner\">\r\n      <div class=\"sbi\"><div class=\"sbi-n warn\">50<\/div><div class=\"sbi-l\">institutions analyzed<\/div><\/div>\r\n      <div class=\"sbi\"><div class=\"sbi-n\">~33<\/div><div class=\"sbi-l\">sector average \/ 100<\/div><\/div>\r\n      <div class=\"sbi\"><div class=\"sbi-n\">100%<\/div><div class=\"sbi-l\">without valid CSP<\/div><\/div>\r\n      <div class=\"sbi\"><div class=\"sbi-n ok\">5\/50<\/div><div class=\"sbi-l\">passing grade (B or higher)<\/div><\/div>\r\n    <\/div>\r\n  <\/div>\r\n\r\n  <article class=\"blog-content\">\r\n    <div class=\"wrap\">\r\n\r\n      <p>Throughout September 2026, UrbaDigital conducted a systematic analysis of Ecuador's public digital infrastructure: one sector per week, four sectors across the month. We used <strong>Mozilla HTTP Observatory<\/strong>, a free and public tool, to assess the security configuration of each institutional portal.<\/p>\r\n\r\n      <p>The result is an x-ray of the Ecuadorian public sector's web security as it stands today: fifty institutions, four very distinct types of work, and a pattern that barely shifts between them.<\/p>\r\n\r\n      <div class=\"note-box\">\r\n        <strong>What does HTTP Observatory measure?<\/strong> It evaluates the configuration of HTTP security headers and produces a score from 0 to 100, mapped to a letter grade (A to F). It does not detect active breaches; it measures how well a site is hardened to prevent them. Eight categories per site: CSP, HSTS, X-Frame-Options, SRI, Cookies, CORS, Redirection handling, and Referrer Policy.\r\n      <\/div>\r\n\r\n      <h2>The Four Sectors at a Glance<\/h2>\r\n\r\n      <div class=\"sector-grid\">\r\n        <div class=\"sec-card\">\r\n          <div class=\"sec-week\">Week of Sep 7<\/div>\r\n          <div class=\"sec-name\">State Platforms<\/div>\r\n          <div class=\"sec-count\">8 institutions \u00b7 DATA593, ANT, CNE \u00d72, IESS Affiliation, GOB.EC, SRI, Quipux<\/div>\r\n          <div class=\"sec-score\"><span class=\"sec-n bad\">25<\/span><span class=\"sec-slash\">\/ 100<\/span><span class=\"grade-badge gb-F\">F<\/span><\/div>\r\n        <\/div>\r\n        <div class=\"sec-card\">\r\n          <div class=\"sec-week\">Week of Sep 15<\/div>\r\n          <div class=\"sec-name\">Public Universities<\/div>\r\n          <div class=\"sec-count\">20 institutions \u00b7 from Yachay Tech (0) to UTM (80)<\/div>\r\n          <div class=\"sec-score\"><span class=\"sec-n warn\">47<\/span><span class=\"sec-slash\">\/ 100<\/span><span class=\"grade-badge gb-C\">C<\/span><\/div>\r\n        <\/div>\r\n        <div class=\"sec-card\">\r\n          <div class=\"sec-week\">Week of Sep 8<\/div>\r\n          <div class=\"sec-name\">Municipalities (GADs)<\/div>\r\n          <div class=\"sec-count\">17 institutions \u00b7 from Guayaquil (0) to Quevedo (70)<\/div>\r\n          <div class=\"sec-score\"><span class=\"sec-n bad\">27.6<\/span><span class=\"sec-slash\">\/ 100<\/span><span class=\"grade-badge gb-F\">F<\/span><\/div>\r\n        <\/div>\r\n        <div class=\"sec-card\">\r\n          <div class=\"sec-week\">Week of Sep 20<\/div>\r\n          <div class=\"sec-name\">Justice and Healthcare<\/div>\r\n          <div class=\"sec-count\">5 institutions \u00b7 Fiscal\u00eda, IESS Appointment System, MSP, ARCSA, Contacto Ciudadano<\/div>\r\n          <div class=\"sec-score\"><span class=\"sec-n bad\">27<\/span><span class=\"sec-slash\">\/ 100<\/span><span class=\"grade-badge gb-F\">F<\/span><\/div>\r\n        <\/div>\r\n      <\/div>\r\n\r\n      <p>Three out of the four sectors average below 30 out of 100. The exception was the university sector, where four institutions \u2014UTM, EPN, UTN, UG\u2014 scored 75 or higher and lifted the average to 47.<\/p>\r\n\r\n      <h2>All Results \u2014 From Worst to Best<\/h2>\r\n\r\n      <div class=\"infographic-wrapper\">\r\n        <div class=\"infographic-title\">HTTP Observatory Score by Institution \u2014 September 2026<\/div>\r\n        <div class=\"infographic-sub\">50 institutions \u00b7 scale 0\u2013100 \u00b7 passing threshold \u2265 70 (Grade B or higher)<\/div>\r\n\r\n        <div class=\"chart-grp\">State Platforms \u00b7 8 institutions<\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">DATA593 (DINARP)<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:.5%\"><\/div><\/div><span class=\"chart-val vF\">0<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">ANT \u2014 Web Query<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:.5%\"><\/div><\/div><span class=\"chart-val vF\">0<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">CNE \u2014 Polling Place<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:10%\"><\/div><\/div><span class=\"chart-val vF\">10<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">CNE \u2014 Main Portal<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:10%\"><\/div><\/div><span class=\"chart-val vF\">10<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">IESS \u2014 Affiliation<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-D\" style=\"width:35%\"><\/div><\/div><span class=\"chart-val vD\">35<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">GOB.EC \u2014 Citizen Portal<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-C\" style=\"width:45%\"><\/div><\/div><span class=\"chart-val vC\">45<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">SRI en L\u00ednea<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-C\" style=\"width:50%\"><\/div><\/div><span class=\"chart-val vC\">50<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Quipux \u2014 Document Management<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-C\" style=\"width:50%\"><\/div><\/div><span class=\"chart-val vC\">50<\/span><\/div>\r\n\r\n        <div class=\"chart-grp\">Justice and Healthcare \u00b7 5 institutions<\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Contacto Ciudadano<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:.5%\"><\/div><\/div><span class=\"chart-val vF\">0<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Fiscal\u00eda \u2014 Case inquiry<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:10%\"><\/div><\/div><span class=\"chart-val vF\">10<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">IESS \u2014 Online appointment system<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:20%\"><\/div><\/div><span class=\"chart-val vF\">20<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">ARCSA \u2014 Sanitary Control<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-D\" style=\"width:35%\"><\/div><\/div><span class=\"chart-val vD\">35<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Ministry of Public Health<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-B\" style=\"width:70%\"><\/div><\/div><span class=\"chart-val vB\">70<\/span><\/div>\r\n\r\n        <div class=\"chart-grp\">Municipalities \/ GADs \u00b7 17 institutions<\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Ambato \u00b7 Guayaquil \u00b7 Manta \u00b7 Ibarra<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:.5%\"><\/div><\/div><span class=\"chart-val vF\">0<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Loja<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:5%\"><\/div><\/div><span class=\"chart-val vF\">5<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Machala<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:10%\"><\/div><\/div><span class=\"chart-val vF\">10<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Guaranda<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:15%\"><\/div><\/div><span class=\"chart-val vF\">15<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Babahoyo<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-D\" style=\"width:25%\"><\/div><\/div><span class=\"chart-val vD\">25<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Portoviejo \u00b7 Riobamba<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-D\" style=\"width:30%\"><\/div><\/div><span class=\"chart-val vD\">30<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Lago Agrio \u00b7 Tulc\u00e1n<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-D\" style=\"width:35%\"><\/div><\/div><span class=\"chart-val vD\">35<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Latacunga<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-C\" style=\"width:50%\"><\/div><\/div><span class=\"chart-val vC\">50<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Azogues \u00b7 Quito \u00b7 Esmeraldas<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-C\" style=\"width:55%\"><\/div><\/div><span class=\"chart-val vC\">55<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Quevedo \u2713<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-B\" style=\"width:70%\"><\/div><\/div><span class=\"chart-val vB\">70<\/span><\/div>\r\n\r\n        <div class=\"chart-grp\">Public Universities \u00b7 20 institutions<\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">Yachay Tech \u00b7 ESPOCH \u00b7 ESPOL<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:.5%\"><\/div><\/div><span class=\"chart-val vF\">0<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">UTC<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:5%\"><\/div><\/div><span class=\"chart-val vF\">5<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">UPEC<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-F\" style=\"width:15%\"><\/div><\/div><span class=\"chart-val vF\">15<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">UTA<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-D\" style=\"width:25%\"><\/div><\/div><span class=\"chart-val vD\">25<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">UNL<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-D\" style=\"width:35%\"><\/div><\/div><span class=\"chart-val vD\">35<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">ESPAM \u00b7 UNEMI<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-C\" style=\"width:50%\"><\/div><\/div><span class=\"chart-val vC\">50<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">UTB \u00b7 UCE \u00b7 UEA \u00b7 UTMachala<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-C\" style=\"width:55%\"><\/div><\/div><span class=\"chart-val vC\">55<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">UCuenca<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-C\" style=\"width:60%\"><\/div><\/div><span class=\"chart-val vC\">60<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">UTEQ<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-C\" style=\"width:65%\"><\/div><\/div><span class=\"chart-val vC\">65<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">ESPE<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-B\" style=\"width:70%\"><\/div><\/div><span class=\"chart-val vB\">70<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">UG \u00b7 UTN \u00b7 EPN<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-B\" style=\"width:75%\"><\/div><\/div><span class=\"chart-val vB\">75<\/span><\/div>\r\n        <div class=\"chart-row\"><span class=\"chart-label\">UTM \u2014 sector's best<\/span><div class=\"chart-bar-track\"><div class=\"chart-bar-fill bf-B\" style=\"width:80%\"><\/div><\/div><span class=\"chart-val vB\">80<\/span><\/div>\r\n\r\n        <div class=\"chart-legend\">\r\n          <span class=\"cl-item\"><span class=\"cl-dot\" style=\"background:#b84040\"><\/span>F \u2014 critical (0\u201324)<\/span>\r\n          <span class=\"cl-item\"><span class=\"cl-dot\" style=\"background:#a06820\"><\/span>D \u2014 poor (25\u201349)<\/span>\r\n          <span class=\"cl-item\"><span class=\"cl-dot\" style=\"background:#8a7810\"><\/span>C \u2014 acceptable (50\u201369)<\/span>\r\n          <span class=\"cl-item\"><span class=\"cl-dot\" style=\"background:#2a8a56\"><\/span>B \u2014 passing (70+)<\/span>\r\n          <span class=\"cl-item\">Source: WebPerformance Report \u00b7 HTTP Observatory \u00b7 Sep 2026<\/span>\r\n        <\/div>\r\n      <\/div>\r\n\r\n      <h2>What Failed Across All Four Sectors<\/h2>\r\n\r\n      <p>Certain failures surfaced in every sector, without exception.<\/p>\r\n\r\n      <div class=\"stat-grid\">\r\n        <div class=\"stat-card\">\r\n          <div class=\"sc-name\">Content-Security-Policy (CSP)<\/div>\r\n          <div class=\"sc-n\">50 of 50<\/div>\r\n          <div class=\"sc-desc\">Not a single site had a valid CSP. This header governs which scripts can execute on the page \u2014 its absence is the most common enabler of Cross-Site Scripting (XSS) attacks.<\/div>\r\n        <\/div>\r\n        <div class=\"stat-card\">\r\n          <div class=\"sc-name\">X-Frame-Options<\/div>\r\n          <div class=\"sc-n\">~40 of 50<\/div>\r\n          <div class=\"sc-desc\">Missing in approximately 80% of sites. Without it, a page can be embedded inside a third-party iframe \u2014 the primary vector for clickjacking attacks against citizens submitting forms.<\/div>\r\n        <\/div>\r\n        <div class=\"stat-card\">\r\n          <div class=\"sc-name\">HSTS<\/div>\r\n          <div class=\"sc-n warn\">~35 of 50<\/div>\r\n          <div class=\"sc-desc\">Without HTTP Strict Transport Security, a session can be downgraded from HTTPS to plaintext HTTP and intercepted across shared or public networks.<\/div>\r\n        <\/div>\r\n        <div class=\"stat-card\">\r\n          <div class=\"sc-name\">Cookies (Secure Attribute)<\/div>\r\n          <div class=\"sc-n warn\">~20 of 50<\/div>\r\n          <div class=\"sc-desc\">Session cookies delivered without the Secure flag can be intercepted across unencrypted channels \u2014 especially critical in authenticated systems like the IESS appointment manager.<\/div>\r\n        <\/div>\r\n      <\/div>\r\n\r\n      <p>The 100% failure rate for CSP across all tested services is not a coincidence: it is a structural pattern. We saw it in municipalities. We saw it in universities. We see it once again here. It reflects default configurations that simply are not being enforced at the web server or reverse proxy layer across vast portions of Ecuador's public digital infrastructure.<\/p>\r\n\r\n      <h2>The Five Institutions That Passed<\/h2>\r\n\r\n      <p>Five institutions obtained a passing grade of B or higher. What they share is far more instructive than what sets them apart.<\/p>\r\n\r\n      <div class=\"exc-list\">\r\n        <div class=\"exc\">\r\n          <div class=\"exc-score\">80<\/div>\r\n          <div>\r\n            <div class=\"exc-name\">UTM \u2014 Technical University of Manab\u00ed<\/div>\r\n            <div class=\"exc-why\">Highest score among all 50 institutions. Server configuration enables multiple security headers by default.<\/div>\r\n          <\/div>\r\n        <\/div>\r\n        <div class=\"exc\">\r\n          <div class=\"exc-score\">75<\/div>\r\n          <div>\r\n            <div class=\"exc-name\">UG \u00b7 UTN \u00b7 EPN<\/div>\r\n            <div class=\"exc-why\">Three universities with consistent header configurations and nginx setups with security enabled by default.<\/div>\r\n          <\/div>\r\n        <\/div>\r\n        <div class=\"exc\">\r\n          <div class=\"exc-score\">70<\/div>\r\n          <div>\r\n            <div class=\"exc-name\">MSP \u2014 Ministry of Public Health<\/div>\r\n            <div class=\"exc-why\">Only institution in the State and justice\/healthcare sectors that passed. Uses nginx with security headers enabled.<\/div>\r\n          <\/div>\r\n        <\/div>\r\n        <div class=\"exc\">\r\n          <div class=\"exc-score\">70<\/div>\r\n          <div>\r\n            <div class=\"exc-name\">Quevedo \u2014 Municipal GAD<\/div>\r\n            <div class=\"exc-why\">Only municipality that passed. Routes traffic through Cloudflare, which injects security headers by default \u2014 not due to deliberate local configuration.<\/div>\r\n          <\/div>\r\n        <\/div>\r\n      <\/div>\r\n\r\n      <div class=\"pull-quote\">\r\n        <p>The difference between a B and an F in HTTP Observatory is rarely a matter of budget. It is almost always a matter of configuration.<\/p>\r\n      <\/div>\r\n\r\n      <hr>\r\n\r\n      <h2>The LOPDP Dimension<\/h2>\r\n\r\n      <p>The Organic Law on Personal Data Protection classifies certain data categories as sensitive under Article 6: health data, judicial and criminal records, genetic data, and information relating to an individual's legal status. Institutions processing these categories are legally required to implement reinforced technical safeguards.<\/p>\r\n\r\n      <div class=\"legal-callout\">\r\n        <div class=\"legal-callout-title\">LOPDP \u00b7 Art. 6 \u2014 Sensitive Data<\/div>\r\n        <h3>Special Categories of Processing<\/h3>\r\n        <p>Health data, genetic information, judicial and criminal records, and data regarding an individual's legal status are classified as sensitive. Their processing demands reinforced technical and organizational safeguards.<\/p>\r\n      <\/div>\r\n\r\n      <div class=\"legal-callout warning\">\r\n        <div class=\"legal-callout-title\">LOPDP \u00b7 Art. 37 \u2014 Security of Personal Data<\/div>\r\n        <h3>Security Obligations of the Controller<\/h3>\r\n        <p>Data controllers must implement technical safeguards that guarantee the confidentiality, integrity, and availability of personal data[cite: 1]. A missing HSTS header, cookies transmitted without the Secure flag, and the total absence of CSP are concrete technical deficiencies directly pertinent to this legal obligation.<\/p>\r\n        <p>The LOPDP applies to public entities without exception. The Superintendence of Personal Data Protection has been active since 2023 and has initiated enforcement proceedings \u2014 including regulatory sanctions in 2025 against LigaPro (~$250K) and the Ecuadorian Football Federation (~$200K). <strong>Ecuador maintains some of the highest statutory penalties in the region for non-compliance: up to 2% of annual turnover for serious infractions.<\/strong><\/p>\r\n      <\/div>\r\n\r\n      <p>We do not state that these portals have experienced a breach or that data has been leaked. What the findings of this analysis establish is that their present configuration fails to meet the technical baseline mandated by the LOPDP for the categories of data they handle. The law does not wait for an incident to occur before imposing duties \u2014 it mandates preventive security controls in advance.<\/p>\r\n\r\n      <hr>\r\n\r\n      <h2>Five Patterns from September<\/h2>\r\n\r\n      <div class=\"findings\">\r\n        <div class=\"finding f-red\"><strong>CSP is a universal failure.<\/strong> 50 institutions analyzed across four sectors. None had a valid Content-Security-Policy header. It is not individual negligence \u2014 it is a structural deficit in Ecuador's public digital infrastructure.<\/div>\r\n        <div class=\"finding f-red\"><strong>Portals handling the most sensitive data hold the lowest scores.<\/strong> Fiscal\u00eda (judicial records), IESS Appointment System (health data), and Contacto Ciudadano (citizen grievances) received an F \u2014 precisely the portals that the LOPDP mandates to provide the most robust protections.<\/div>\r\n        <div class=\"finding f-warn\"><strong>Scale and prestige do not predict security.<\/strong> Guayaquil (2.6M residents) scored 0. ESPOL \u2014 one of Ecuador's most prestigious engineering schools \u2014 scored 0. UTM scored 80. The decisive variable is server configuration, not institutional stature.<\/div>\r\n        <div class=\"finding f-gold\"><strong>Universities outperformed all other sectors.<\/strong> An average of 47, compared to 25\u201328 across the rest. Four universities scored 75 or higher. The university sector exhibits more diverse IT practices, with certain teams actively maintaining header configurations.<\/div>\r\n        <div class=\"finding f-green\"><strong>Remediation is not expensive.<\/strong> Every institution that passed did so through server-level header configuration \u2014 without replacing infrastructure or purchasing specialized software. HSTS, X-Frame-Options, and Referrer Policy can be added in minutes. The gap between a 0 and a 70 is configuration hygiene.<\/div>\r\n      <\/div>\r\n\r\n      <hr>\r\n\r\n      <h2>Methodology<\/h2>\r\n\r\n      <div class=\"method-box\">\r\n        <strong>Tool:<\/strong> Mozilla HTTP Observatory (via webperformancereport.com) \u00b7 <strong>Evaluation Period:<\/strong> September 7\u201320, 2026 \u00b7 <strong>Total Institutions:<\/strong> 50 \u00b7 <strong>Sectors:<\/strong> Central State platforms (8), public universities (20), municipal GADs (17), justice and healthcare portals (5) \u00b7 <strong>Selection Criteria:<\/strong> Citizen-facing portals with direct interaction \u2014 authentication, data submission, case inquiries, appointment scheduling, grievance filings \u00b7 All scans are public and independently reproducible at <code>observatory.mozilla.org<\/code>.\r\n      <\/div>\r\n\r\n      <p>This report is the final release in UrbaDigital's September 2026 series. Earlier editions covered 17 municipal GAD portals (September 8), 20 public university domains (September 15), and 5 justice and healthcare portals (September 20).<\/p>\r\n\r\n      <div class=\"cta-box\">\r\n        <div class=\"cta-eyebrow\">Complimentary Web Security Diagnostic for Your Institution<\/div>\r\n        <h2>Is Your Portal Configured This Way Too?<\/h2>\r\n        <p>We run HTTP Observatory and compare your technical posture against the requirements of the LOPDP. You receive an actionable findings report and a prioritized remediation roadmap \u2014 at no cost.<\/p>\r\n        <a href=\"https:\/\/urbadigital.com\/contacto\" class=\"cta-btn\">Request an Evaluation<\/a>\r\n      <\/div>\r\n\r\n      <hr>\r\n\r\n      <div class=\"art-foot\">\r\n        <div>\r\n          <div class=\"af-name\">UrbaDigital S.A.<\/div>\r\n          <div class=\"af-role\">Digital Transformation \u00b7 Quito, Ecuador<\/div>\r\n        <\/div>\r\n        <div class=\"af-tags\">\r\n          <span class=\"ftag\">Web Security<\/span>\r\n          <span class=\"ftag\">LOPDP<\/span>\r\n          <span class=\"ftag\">HTTP Observatory<\/span>\r\n          <span class=\"ftag\">Public Sector<\/span>\r\n          <span class=\"ftag\">#UrbaInsights<\/span>\r\n          <span class=\"ftag\">Ecuador<\/span>\r\n        <\/div>\r\n      <\/div>\r\n\r\n    <\/div>\r\n  <\/article>\r\n\r\n<\/div>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4c111caa e-con-full e-flex e-con e-child\" data-id=\"4c111caa\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4766dcc3 ekit-equal-height-disable elementor-widget elementor-widget-elementskit-icon-box\" data-id=\"4766dcc3\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"elementskit-icon-box.default\">\n\t\t\t\t\t<div class=\"ekit-wid-con\" >        <!-- link opening -->\n                <!-- end link opening -->\n\n        <div class=\"elementskit-infobox text-center text- icon-lef-right-aligin elementor-animation-   \">\n                        <div class=\"box-body\">\n                            <h3 class=\"elementskit-info-box-title\">\n                    Need Help?                <\/h3>\n                                            <\/div>\n        \n        \n                <\/div>\n        <\/div>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6df471b elementor-align-center elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"6df471b\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"icon-list.default\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"mailto:info@urbadigital.com\">\n\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"20\" height=\"18\" viewBox=\"0 0 20 18\" fill=\"currentColor\"><path d=\"M18.5352 2.92871C18.5352 2.55396 18.2312 2.25 17.8564 2.25H2.14258C1.76781 2.25 1.46387 2.55395 1.46387 2.92871V15.0713C1.46387 15.4461 1.76782 15.75 2.14258 15.75H17.8564C18.2312 15.75 18.5352 15.4461 18.5352 15.0713V2.92871ZM20.0352 15.0713C20.0352 16.2745 19.0597 17.25 17.8564 17.25H2.14258C0.939373 17.25 -0.0361328 16.2745 -0.0361328 15.0713V2.92871C-0.0361328 1.72552 0.939387 0.75 2.14258 0.75H17.8564C19.0596 0.75 20.0352 1.7255 20.0352 2.92871V15.0713Z\"><\/path><path d=\"M18.7984 2.71521C19.1135 2.44643 19.5862 2.48413 19.8551 2.7992C20.1237 3.11419 20.0868 3.58696 19.7721 3.85584L11.4 10.9994L11.3932 11.0043C11.0018 11.3302 10.509 11.5091 9.9996 11.5092C9.4901 11.5092 8.9965 11.3303 8.60507 11.0043L8.59823 10.9994L0.227136 3.85584C-0.0879085 3.58703 -0.12555 3.1143 0.143152 2.7992C0.411962 2.48415 0.884692 2.44651 1.19979 2.71521L9.56503 9.85193L9.66171 9.91932C9.76386 9.97789 9.88051 10.0092 9.9996 10.0092C10.1581 10.0091 10.3114 9.95337 10.4332 9.85193L18.7984 2.71521Z\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">info@urbadigital.com<\/span>\n\t\t\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6081008c elementor-invisible elementor-widget elementor-widget-elementskit-creative-button\" data-id=\"6081008c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_animation&quot;:&quot;fadeInUp&quot;,&quot;_animation_delay&quot;:200,&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"elementskit-creative-button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"ekit-wid-con\" >\t\t<div class=\"ekit-btn-wraper\">\n\t\t\t\t\t\t\t\t<a href=\"\/contact-us\/\" class=\"ekit_creative_button ekit_position_aware\" id=\"\" data-text=\"\">\n\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"ekit_creative_button_text\">Contact Us<\/span>\n\n\t\t\t\t\t\t\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10\" height=\"10\" viewBox=\"0 0 10 10\" fill=\"currentColor\"><path d=\"M8.33624 2.84003L1.17628 10L0 8.82373L7.15913 1.66376H0.849348V0H10V9.15065H8.33624V2.84003Z\"><\/path><\/svg>\n\t\t\t\t\t\t\t\t\t\t\t\t<span class='ekit_position_aware_bg'><\/span>\t\t\t\t\t<\/a>\n\t\t\t\t\t\t<\/div>\n        <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Consolidated Research \u00b7 HTTP Observatory \u00b7 September 2026 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":15357,"comment_status":"closed","ping_status":"open","sticky":false,"template":"elementor_header_footer","format":"standard","meta":{"_angie_page":false,"_monsterinsights_skip_tracking":false,"page_builder":"","footnotes":""},"categories":[84,1,83],"tags":[],"class_list":["post-15356","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-article","category-blog","category-studies"],"aioseo_notices":[],"rttpg_featured_image_url":{"full":["https:\/\/urbadigital.com\/wp-content\/uploads\/2026\/09\/Gemini_Generated_Image_y2fbb5y2fbb5y2fb-scaled.jpg",2560,1429,false],"landscape":["https:\/\/urbadigital.com\/wp-content\/uploads\/2026\/09\/Gemini_Generated_Image_y2fbb5y2fbb5y2fb-scaled.jpg",2560,1429,false],"portraits":["https:\/\/urbadigital.com\/wp-content\/uploads\/2026\/09\/Gemini_Generated_Image_y2fbb5y2fbb5y2fb-scaled.jpg",2560,1429,false],"thumbnail":["https:\/\/urbadigital.com\/wp-content\/uploads\/2026\/09\/Gemini_Generated_Image_y2fbb5y2fbb5y2fb-150x150.jpg",150,150,true],"medium":["https:\/\/urbadigital.com\/wp-content\/uploads\/2026\/09\/Gemini_Generated_Image_y2fbb5y2fbb5y2fb-300x167.jpg",300,167,true],"large":["https:\/\/urbadigital.com\/wp-content\/uploads\/2026\/09\/Gemini_Generated_Image_y2fbb5y2fbb5y2fb-1024x572.jpg",800,447,true],"1536x1536":["https:\/\/urbadigital.com\/wp-content\/uploads\/2026\/09\/Gemini_Generated_Image_y2fbb5y2fbb5y2fb-1536x857.jpg",1536,857,true],"2048x2048":["https:\/\/urbadigital.com\/wp-content\/uploads\/2026\/09\/Gemini_Generated_Image_y2fbb5y2fbb5y2fb-2048x1143.jpg",2048,1143,true],"trp-custom-language-flag":["https:\/\/urbadigital.com\/wp-content\/uploads\/2026\/09\/Gemini_Generated_Image_y2fbb5y2fbb5y2fb-18x10.jpg",18,10,true]},"rttpg_author":{"display_name":"urbasignature","author_link":"https:\/\/urbadigital.com\/es\/blog\/author\/urbasignature\/"},"rttpg_comment":0,"rttpg_category":"<a href=\"https:\/\/urbadigital.com\/es\/blog\/category\/article\/\" rel=\"category tag\">Article<\/a> <a href=\"https:\/\/urbadigital.com\/es\/blog\/category\/blog\/\" rel=\"category tag\">Blog<\/a> <a href=\"https:\/\/urbadigital.com\/es\/blog\/category\/studies\/\" rel=\"category tag\">Studies<\/a>","rttpg_excerpt":"Consolidated Research \u00b7 HTTP Observatory \u00b7 September 2026 [&hellip;]","_links":{"self":[{"href":"https:\/\/urbadigital.com\/es\/wp-json\/wp\/v2\/posts\/15356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/urbadigital.com\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/urbadigital.com\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/urbadigital.com\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/urbadigital.com\/es\/wp-json\/wp\/v2\/comments?post=15356"}],"version-history":[{"count":4,"href":"https:\/\/urbadigital.com\/es\/wp-json\/wp\/v2\/posts\/15356\/revisions"}],"predecessor-version":[{"id":15362,"href":"https:\/\/urbadigital.com\/es\/wp-json\/wp\/v2\/posts\/15356\/revisions\/15362"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/urbadigital.com\/es\/wp-json\/wp\/v2\/media\/15357"}],"wp:attachment":[{"href":"https:\/\/urbadigital.com\/es\/wp-json\/wp\/v2\/media?parent=15356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/urbadigital.com\/es\/wp-json\/wp\/v2\/categories?post=15356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/urbadigital.com\/es\/wp-json\/wp\/v2\/tags?post=15356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}