Propuesta para un adecuado manejo de la seguridad de la información en base a la norma ISO 27002 para la Dirección de Gestión Tecnológica del Ministerio del Deporte, Quito

Abstract

Public and private companies must meet minimum requirements in managing the security of their information, as mentioned in the “Registro Oficial No. 88”. In this context, the “Dirección de Gestión Tecnológica del Ministerio del Deporte, Quito”, requires taking measures to encourage the information security. To achieve this, it is performed in this draft proposal for an appropriate management of information security based on ISO/IEC 27002:2005. In the first instance, it is revised the necessary theoretical foundation for the project, which includes: revised Methodologies for the analysis and evaluation of risks, PDCA model and the guidelines of the ISO/IEC 27002:2005. Subsequently the current state of the Department of Technology Management is analyzed and established guidelines for Risk Analysis; in this process are identified and assessed the assets, threats, vulnerabilities, likelihood of occurrence of an event and its impact. Based on the results of the Analysis and Risk Assessment is presented the Statement of Applicability and Security Policy Address proposed, including some procedures. Finally, conclusions and recommendations of the project are presented.