MODELO INTEGRADO DE GESTIÓN DE RIESGOS DE SEGURIDAD EN LOS DEPARTAMENTOS DE TIC.

Abstract

In the present work the rules that constitute the basis for the development of a management model were analyzed, selecting the most suitable ones according to their characteristics of adaptability in the Departments of Information and Communication Technologies (ICT), applicable to any public organization or Private. For the review of the information, the most relevant aspects were considered regarding the general processes that correspond to the ITIL, ISO 9001, 31000, 27005, 17799, COBIT standards. Among the analyzed parts obtained from the revision of bibliographic sources are: the scope, the organizational context, the support and the improvement for the organization. Once the advantages provided by the regulations analyzed were established, the most relevant norms and characteristics were chosen for the elaboration of the risk management model and its validation. As a result, the ISO 9001, 27005 and 31000 standards presented adaptable and applicable characteristics to an integrated risk management model, which is in line with the requirements of ICT, as well as the processes and information assets related to them; Additionally, the model was applied to the Attorney General of El Oro with the purpose of validating the same. In the analysis it was determined that the organization has a level of compliance of the proposed model of 59%. The results of the application of this standard depended on the organization in which the company is run. It can be verified that one of the most important parts for the proper management of the security risks is the periodic and documented revisions that contemplate the appropriate means of internal communication