Propuesta metodológica basada en ISO 27000,para cumplir requerimientos de seguridad informática exigidos por la Agencia de Regulación y Control de las Telecomunicaciones en micro-empresas proveedoras de internet, caso Maxxnet.

Abstract

The fundamental objective of this research work was to propose a methodology based on ISO 27000 for compliance with the computer security requirements demanded by the Telecommunications Regulation and Control Agency (ARCOTEL) in microenterprises providing Internet access, applied to the Maxxnet case study. In the development of the research, the deductive method was used with a quantitative approach. Likewise, a documentary review, observation, analysis of criticality reports, vulnerability analysis, port scanning, evidence of implementation and management were carried out. In addition, it was necessary to use spreadsheets, openvas, nessus, nmap, network equipment commands, and checklist, which helped analyze and propose a computer security management methodology for microenterprises based on ISO 27000 Standards. After the analysis , the alignment of requirements and the particular characteristics, a methodological proposal was generated based on eight interrelated processes, adopting 58 of the 114 controls suggested in the ISO 27002 standard of 2013, in addition, formats of security policies, procedures, checklists were developed. , manuals and open source tools are proposed that make it possible to demonstrate the execution of a security management system, and at the same time generate the implementation documents required by the control entities. Consequently, the implementation of the proposed methodology in the Maxxnet case study allowed measuring its effectiveness and evidencing opportunities for improvement in computer security management, achieving total compliance of 55% and partial compliance of 45% of the proposed controls. In this sense, it is recommended to expand the controls proposed by the methodology, because it focuses on compliance with the requirements demanded by ARCOTEL; however, the needs of microenterprises can be much broader.