Plan de Gestión de Seguridad de la Información para la Cooperativa de Ahorro y Crédito Kullki Wasi.

Abstract

Introduction part: consists in six sections. The first one sets the problem regarding the information security management, the second section sets the objective of the project which pretend to help the company to improve the information security management, the third section defines the scope of the project, in the fourth section a inspection of the company is made starting with its strategic plan and with more detail about the Technology Department, the fifth section is dedicated to the selections and justifying the policy and standard with which this project will be carry out. Finally, the sixth section makes a diagnosis on the current situation based on the NTE INEN-ISO/IEC 27001 standard. Methodology application part: this part is divided into three sections dedicated to the evaluation of the security information risks. The first section is about the action plan to analyze risks, the second section describes each step followed according to NIST 800-30 and the third section presents the performance of the risk analysis, in which the possible threats and vulnerabilities that the critical assets are exposed to are identified, supported by tools such as Nessus Nmap and the check list, getting as a result the risk matrix and so the treatment plan and select the controls that the NTE INEN-ISO/27001 proposes and considering the NIST 800-30 security criteria to finally show results obtained in the risk assessment. Results and discussion part: involves the guidelines that should be carried out to the implantation of the selected controls and consists in five sections. The first one shows what an Information Security Management System consists of according to the NTE INEN-ISO/27001 standard, the second section define the scope and limits of this project, in the third section, it is shown the phases that should be accomplished to make the Information Security Management plan with the deliverables done throughout the elaboration of the plan and according to what the standard sets, in the fourth section, it is set an implementation guide to be carried out if the company authorities accept the performance of the mentioned plan and finally, in the fifth section the applicability of the proposal is done by comparing the current accomplishment state with the expected.