Auditoría informática dirigida al Centro de Cómputo de la Carrera de Ingeniería en Sistemas Computacionales de la Universidad de Guayaquil con base en las Normas ISO 27001 y 27002.
Fecha
2020-06
Título de la revista
ISSN de la revista
Título del volumen
Editor
Universidad de Guayaquil. Facultad de Ciencias Matemáticas y Físicas. Carrera de Ingeniería en Sistemas Computacionales.
Resumen
Al menos en los tres últimos años no se han realizado auditorías informáticas
en el centro de cómputo de la Carrera de Ingeniería en Sistemas
Computacionales de la Universidad de Guayaquil, por lo que es necesaria una
auditoría informática interna que permita conocer el nivel en que se encuentra
la seguridad de la información para brindar recomendaciones de mejora y
realizar una política de seguridad de la información. Para conseguir los
objetivos se usó una adaptación de la metodología para auditoría COBIT 4.1
en combinación con el modelo PDCA. También se aplicó la metodología para
el análisis de riesgos MAGERIT. Se analizaron los riesgos de los activos y se
evaluaron los controles según lo indicado por las normas ISO 27001 e ISO
27002, además de una revisión de los requisitos obligatorios por la norma ISO
27001. Como resultado, no existe el 42% de los controles considerados
relevantes para una óptima seguridad de la información, el 24% de controles
se ubican en un estado inicial, el 5% tienen un mejor estado pero se realizan
de modo informal y solo el 2% de controles tienen documentación formal,
ninguno es llevado a cabo por un documento aprobado por la Dirección, el 2%
de los controles no han sido verificados y el 25% son considerados como no
aplicables para el centro de cómputo. Actualmente se cumple con el 4% de
los requisitos obligatorios por la Norma ISO 27001. Si se aprueban y aplican
correctamente las políticas de seguridad de la información; se estima que el
estado de implementación sería del 37% de los requisitos en una etapa inicial,
41% de requisitos formalizados y documentados, quedando aún sin cumplir el
22%.
At least in the last three years there has not been computer auditing in the computing center of the Carrer in Computer Systems Engineering of the Universidad de Guayaquil, so an internal computer audit is necessary to know the level of information security to provide recommendations for improvement and to make an information security policy. To achieve the objectives, an adaptation of the COBIT 4.1 audit methodology was used in combination with the PDCA model. The MAGERIT risk analysis methodology was also applied. The risks of the assets were analyzed and the controls were evaluated as indicated by ISO 27001 and ISO 27002, in addition to a review of the requirements required by ISO 27001. As a result, 42% of the controls considered relevant for optimal information security do not exist, 24% of controls are in an initial state, 5% are in a better state but are performed informally and only 2% of controls have formal documentation, none are performed by a document approved by management, 2% of controls have not been verified and 25% are considered not applicable for the computer centre. Currently, 4% of the mandatory requirements of ISO 27001 are met. If the information security policies are approved and correctly applied, it is estimated that the implementation status would be 37% of the requirements in an initial stage, 41% of requirements formalized and documented, with 22% still not met.
At least in the last three years there has not been computer auditing in the computing center of the Carrer in Computer Systems Engineering of the Universidad de Guayaquil, so an internal computer audit is necessary to know the level of information security to provide recommendations for improvement and to make an information security policy. To achieve the objectives, an adaptation of the COBIT 4.1 audit methodology was used in combination with the PDCA model. The MAGERIT risk analysis methodology was also applied. The risks of the assets were analyzed and the controls were evaluated as indicated by ISO 27001 and ISO 27002, in addition to a review of the requirements required by ISO 27001. As a result, 42% of the controls considered relevant for optimal information security do not exist, 24% of controls are in an initial state, 5% are in a better state but are performed informally and only 2% of controls have formal documentation, none are performed by a document approved by management, 2% of controls have not been verified and 25% are considered not applicable for the computer centre. Currently, 4% of the mandatory requirements of ISO 27001 are met. If the information security policies are approved and correctly applied, it is estimated that the implementation status would be 37% of the requirements in an initial stage, 41% of requirements formalized and documented, with 22% still not met.
Descripción
PDF
Palabras clave
Auditoría informática, Centro de cómputo, MAGERIT, ISO 27001, ISO 27002, Computer audit, Computing center, MAGERIT, ISO 27001, ISO 27002