Diseño y evaluación de un plan director de seguridad de información en el Gobierno Municipal del Cantón Morona para mitigar vulnerabilidades de la información utilizando norma ISO 27000.

Abstract

The main objective of this research was to develop a security plan proposal to prevent vulnerabilities for the Canton Morona Local Government’s computing platform, by following ISO 27000 norm. In that respect, different tests were conducted designed to penetrate such computing platform in order to detect its vulnerabilities, meanwhile, a security plan was implemented based on security policies following the ISO 27000 norm for prevention. The detection of vulnerabilities was based on 8 from a total of 10 security risks framed in OWASP Top10-2017, using Nessus, Vega, BurpSuitey Zenmap, Kali Linux (metasploit), as exploitation and scanning tools. This allowed the identification of security failures such as malicious injectioncode, uthentication lost, sensitive data exposure, access control lost, incorrect security control, the use of components with known vulnerabilities and insufficient register and monitoring. By conducting the research, it was determined that the computing platform was 100% vulnerable, being that the reason why the security plan was created with the introduction of best practices according to those vulnerabilities found, which was implemented for a sampling period of two months, resulting in a significant improvement in security levels, reducing the vulnerabilities from 8 to 2, subsequently presenting an improvement of 75% in the security of the platform overall. Therefore, it is recommended to continue implementing security policiesto generate a preventionculture within the public servants in order to prevent risky situations from occurring.