Diseño de un sistema de gestión de seguridad de la información para la planta central del Ministerio de Cultura y Patrimonio

Abstract

The objective of this Degree Project is to design an ISMS (Information Security Management System) for the Central Plant of the MCyP (Ministerio de Cultura y Patrimonio), of the Republic of Ecuador.

Chapter 1 includes the conceptual part: concepts related to ISMS, description of the ISO / IEC 27000, 27001, 27002 and 27005 standards on which the project is based, of the relevant standardization and regulation organizations, of EGSI (version 2.0) and of MAGERIT and MEHARI methodologies.

Chapter 2 exposes the Methodology developed for this project, based on the aforementioned standards; the context of the Institution is determined; A Risk Analysis and Evaluation Method is developed, which includes techniques from the previously studied methodologies; Valuation criteria are defined, assets and dependencies between them are identified, a Risk Analysis is carried out determining impact, probability and potential risk, and a PC program is developed to expedite the calculation processes; A Risk Assessment is made, and options for Risk Treatment are developed.

In Chapter 3, Information Security Policies are developed.

Chapter 4 contains the conclusionsand recommendations.20 Annexes are included, which contain the main Risk Matrix, the Statement of Applicability (SoA), dependency diagrams, the Study of threats, vulnerabilities and safeguards, among others.