Implementación de mecanismos de control de acceso a información de identificación personal (pii) de acuerdo con la ley orgánica de protección de datos personales del Ecuador: almacenamiento, preservación, acceso seguro y transparente a pii.

Abstract

The storage, preservation, safe and transparent access to personally identifiable information (PII) is an issue that over time has been taking more into account in the field of information security. In this sense, this project is focused on developing a secure and distributed storage component for the management of PII. The proposed component uses a distributed and fragmented architecture to guarantee the CIA triad (confidentiality, integrity, and availability) of the stored information. Security controls are implemented to be able to access the information, one of these is the verification of digital signatures which maintain the integrity of the data. In addition, a replication process is used to always maintain availability through data synchronization. The threat modeling tool was used to identify and mitigate potential risks and threats that may arise during the storage of sensitive data. Likewise, a risk analysis was carried out to identify and plan contingency management in case threats occur. Finally, a test application that integrates the storage component with two other components, data collection and transfer, was developed to illustrate the viability and effectiveness of the secure and distributed storage component. In summary, the present work provides a practical and effective approach for the storage, preservation, secure and transparent access to personally identifiable information. The distributed and fragmented architecture of the storage component ensures the CIA triad of the stored data, which guarantees the protection of sensitive data.