Implementación de políticas para la gestión de riesgos de seguridad en el manejo de la información académica de la Empresa Pública ESPOCH CONDUESPOCH EP.

Abstract

The objective was to implement policies for the management of security risks in the handling of academic information of the Empresa Pública ESPOCH ConduEspoch EP since the company did not have any such policies. The research begins with a differential analysis based on the self-diagnosis of the ISO 27001 standard of the initial situation of the company, an inventory of sensitive information assets has been made using the MAGERIT methodology, the detection of vulnerabilities and exploits has been carried out, to then establish an ISMS Information Security Management System of the company and determine the information security policies to be implemented, ending with an analysis of the current situation based on the OWASP methodology. As a result of the research, it was possible to improve from 32.38% to 74.6% by applying the information security risk management policy of the school's academic system, which in some way guarantees the confidentiality, availability, and integrity of the data. When the initial information was collected, it was found that the main problem was the lack of a strategic plan and a clear and defined information security policy. Therefore, it is necessary to implement this type of process to help improve the level of information security based on an international standard such as ISO 27001.