Implementación de mecanismos de control de acceso a información de identificación personal (PII) de acuerdo con la ley orgánica de protección de datos personales del Ecuador: mecanismos para la recolección y procesamiento seguro de información de identificación personal (PII).

Abstract

This research implements a secure web application to collect information, following the guidelines established in the Organic Law on Personal Data Protection LOPDP. Using pseudonymization and minimization of personal data, the aim is to reduce the leakage of personal data. Once the data to be processed has been identified, the information is persisted in an intermediate database that allows the storage of minimized and pseudonymized data to be subsequently shown as public data to an external entity. To show a user's private information, the external entity has to go through a security layer where it is verified and authenticated using digital certificates and two-factor verification using an OTP. Subsequently, performance tests are performed to verify how the increased security affects the application's resources and functionality. Performance tests were performed on 3 main components, hard disk, RAM, and cache memory in which favorable results were obtained. Finally, a risk and threat model was performed to identify vulnerabilities and find a way to mitigate them without compromising the performance and availability of the web application.