Diseño de un plan de SGSI para un caso de estudio en el área de TI

Abstract

Nowadays information security has been turned into the main problems within companies due to the information's one of the most valuable assets. Its inappropriate management can affect in a negative way even more when the information is essential to the business. Companies must take appropriate actions in order to prevent and react before possible risk occurrence. Ensure confidentiality, availability and integrity of data and information is mandatory. For this, there are methodologies that help to elaborate guides to handle incidents that may affect the information security. It is important to quantify the risk that exists when information has been compromised. For this, there are tools that allow determining the probability of occurrence regardless of whether its nature is technological or organizational. This tool is Risk Analysis, and allows managing risks by determining if they can be mitigated, accepted, eliminated or transferred. Information Security Management System (ISMS) plan design provide a model in order to protect the Information Assets which allow having more control over the associated risks within the organization. At international level, there is ISO/IEC 27001, which provides a procedure for such management and beside Risk Analysis it is possible to define and elaborate different control that are necessary for the correct risk mitigation associated with information assets.