Auditoría informática a la Empresa Msa Consulting Group basado en la Norma ISO 27005.
Fecha
2020-10
Título de la revista
ISSN de la revista
Título del volumen
Editor
Universidad de Guayaquil. Facultad de Ciencias Matemáticas y Físicas. Carrera de Ingeniería en Sistemas Computacionales.
Resumen
MSA Consulting Group es una empresa que se dedica a brindar servicios profesionales de consultoría integral de la mano con distintas empresas que se especializan en los temas que requieran los clientes en el área a tratar. Sus actividades destaca la importancia de la seguridad de la información, debido a que maneja información sensible de sus clientes. El presente trabajo tuvo como finalidad realizar una auditoría informática para: conocer cuáles son los riesgos a lo que se expone la empresa, medir los niveles de cumplimiento según la norma ISO/EC 27001 para verificar si la empresa se encuentra apta para una futura implementación de un SGSI, además de medir los niveles de riesgo de la empresa según criterios expresados en la norma ISO/IEC 27005. Esta auditoría informática esta basada en la metodología PDCA recomendada por la norma ISO/IEC 27005 y controles proporcionados por la norma ISO 27001 anexo A, la metodología permitió identificar activos, controles existentes y amenazas que presenta la empresa, para luego realizar el cálculo del nivel de riesgo para los activos y controles, representarlos en matrices de calor. El resultado de la auditoría permitió que la empresa conozca los riesgos a los que se encuentra expuesta y su nivel de cumplimiento que posee según la norma ISO/IEC 27001.
MSA Consulting Group is a company dedicated to providing professional services of integral consulting hand in hand with different companies that specialize in the topics required by clients in the area to be treated. Its activities emphasize the importance of information security, since it handles sensitive client information. The purpose of this work was to perform an IT audit to: know what risks the company is exposed to, measure the levels of compliance according to ISO/EC 27001 to verify if the company is suitable for a future implementation of an ISMS, as well as to measure the risk levels of the company according to criteria expressed in ISO/IEC 27005. This computer audit is based on the PDCA methodology recommended by ISO/IEC 27005 and controls provided by ISO 27001 Annex A. The methodology allowed to identify assets, existing controls and threats presented by the company, and then make the calculation of the risk level for assets and controls, represent them in heat matrices. The result of the audit allowed the company to know the risks to which it is exposed and its level of compliance with ISO/IEC 27001.
MSA Consulting Group is a company dedicated to providing professional services of integral consulting hand in hand with different companies that specialize in the topics required by clients in the area to be treated. Its activities emphasize the importance of information security, since it handles sensitive client information. The purpose of this work was to perform an IT audit to: know what risks the company is exposed to, measure the levels of compliance according to ISO/EC 27001 to verify if the company is suitable for a future implementation of an ISMS, as well as to measure the risk levels of the company according to criteria expressed in ISO/IEC 27005. This computer audit is based on the PDCA methodology recommended by ISO/IEC 27005 and controls provided by ISO 27001 Annex A. The methodology allowed to identify assets, existing controls and threats presented by the company, and then make the calculation of the risk level for assets and controls, represent them in heat matrices. The result of the audit allowed the company to know the risks to which it is exposed and its level of compliance with ISO/IEC 27001.
Descripción
PDF
Palabras clave
Auditoría informática, PDCA, Seguridad de la información, ISO/IEC 27001, Computer audit, ISO/IEC 27005, Information security