Propuesta de un ciclo de gestión de riesgos utilizando modelos de amenazas y controles de seguridad ISO/EC 27002 / EGSI / RGPD

Abstract

At present, a greater number of information systems consume and store sensitive data of their different actors, considering that information is a valuable asset, every day there are more attacks that try to steal this data, thus violating not only the systems, but also also the privacy of people. Faced with this reality, it is necessary to carry out adequate risk management, which considers the privacy of the information and allows organizations to protect the sensitive data they possess.

The objective of this Master's thesis is to propose a "Risk Management Cycle", which makes use of the guidelines provided by the ISO 27005 standard, taking into consideration the controls proposed by the international standard ISO 27002, as well as the guidelines of the "Government Information Security Scheme” of the Ecuadorian state and finally considering the European “General Data Protection Regulation” in order to ensure the privacy of sensitive personal data.

The risk management cycle to be proposed will be evaluated through a case study based on different attacks on sensitive information reported in the network, once the study is defined, an automated threat model will be carried out and risk assessment will be carried out they will use attack and defense trees. During the risk management cycle, work will be done with both inherent risk and residual risk, which are the values that will determine how effective the cycle has been.