Gestión de riesgos de seguridad de la información de una empresa y propuesta de mejoras utilizando normas y estándares internacionales

Abstract

This thesis addresses the management of information security risks in a company and proposes improvements using international standards and frameworks, specifically ISO/IEC 27005 and the NIST SP 800-30 methodology. The primary objective is to identify, assess, and mitigate information security risks, thereby strengthening business continuity. To achieve this objective, an exhaustive investigation into international standards that address security policies, procedures, and controls was conducted. An information security committee was formed to carry out a detailed risk assessment, which included the identification and valuation of company-wide assets, as well as the identification of associated threats and vulnerabilities. Subsequently, the assets within the identified critical areas were prioritized based on their impact and likelihood, and specific controls and improvement proposals were defined for their treatment. The evaluation results demonstrate that establishing a risk management framework based on ISO/IEC 27005 and the NIST SP 800-30 methodology is effective in mitigating security incidents and reducing exposure to threats. The proposed improvements include specific controls that address the identified critical areas, such as sensitive data protection, access management, and personnel training, ensuring the protection of the company’s assets and enhancing its security posture. The conclusions confirm the hypothesis that adequate risk management, supported by international standards and frameworks, not only meets the required aspects for mitigating security incidents but also provides clear guidance for the implementation of best practices. This work not only offers a comprehensive solution for information security within the company but also establishes a benchmark of best practices that can be adopted by other organizations seeking to improve their information security.