Análisis de los sistemas de gestión de seguridad de la información mediante la aplicación de la metodología híbrida snail

Abstract

Nowadays, the data or assets of the information, are primordial elements of an organization. The confidentiality, integrity and availability of data are essential to have levels of competitiveness, profitability and business weighting necessary to meet the objectives of the organization and its economy. The diverse amount of controls to implement in an information system entails an enormous effort for the personnel in charge of protecting the data, their information systems are increasingly exposed to threats that look for any existing vulnerability, to expose the company's information assets to all types of fraud, espionage, computer viruses or hacking, taking into account the security incidents caused voluntarily or involuntarily from within the company itself. For these reasons, the purpose of the research is to analyze the methods and techniques used by hybrid methodologies, specifically by the SNAIL methodology, through a framework that integrates the components of the SNAIL methodology, good practices and SGSI, to be applied in the implementation of information security. Taking into consideration that approximately 30% of the controls contained in the international standard ISO,IEC 27002 ,1, are automatable, the result of this work ends with the proposal of an alternative development of SGSI for companies, in terms of the protection and reduction of IS risks, through the use of necessary iterations that allow it to be developed in a shorter time, in a correct and effective manner.