Gestión de riesgos de seguridad de la información en una empresa pública: propuestas de mejoras y adopción de normas nacionales

Abstract

Information security risk management in a public company is essential to protect sensitive data and ensure the integrity, availability and confidentiality of information. However, the lack of structures based on national standards can expose the company to significant vulnerabilities and risks, compromising public trust and operational efficiency, in contrast, the implementation of national standards, such as the Ecuadorian Technical Standard ISO/IEC 27005:2012 and the Guide for information security risk management of MINTEL, is essential to mitigate vulnerabilities and risks. The objective of this project was to propose improvements through the adoption of these standards. The methodology included an exhaustive investigation of the state of the art on information security risk management, with a focus on national standards for the proposal of best practices. Vulnerabilities in the technological infrastructure were documented and a prototype improvement proposal was designed with specific risk mitigation strategies based on ISO/IEC 27001 controls. The key processes considered for risk management included risk analysis, risk treatment, risk acceptance, risk communication and risk monitoring. The evaluation plan focused on validating the feasibility of the proposal through expert surveys. The results supported the hypothesis by demonstrating that the use of national standards made it possible to develop a viable improvement plan for information security in the public company, promoting secure practices in the institution by providing a detailed analysis and concrete recommendations for information security risk management.