Propuesta de una metodología de detección y respuesta a vulnerabilidades para mejorar la seguridad en la red de datos. Caso Práctico: Intranet de la organización no gubernamental World Vision Ecuador.

Abstract

The main objective of this research was to propose a vulnerability detection and response methodology to improve security in a data network. The work carried out was focused, as a practical case, on the intranet of the World Vision Ecuador Non-Governmental Organization. The research methodology used was quasi-experimental, according to which a pre-test of the degree of security of the data network was made, through the search of the vulnerabilities, and a post-test in which the improvement was verified of the security of the data network once the considered responses have been implemented to mitigate the detected vulnerabilities. The tests were carried out in the technological infrastructure of the organization in question, in two different times. The methodology seeks to increase security by working of four security barriers: personal, physical, logical and legal. The phases of the proposed methodology include: study of the target environment, risk assessment, search for vulnerabilities, response to vulnerabilities and final report. As conclusion, the application of the methodology allowed an increase in the security of 16.94% in confidentiality, 18.26% in integrity and 26.6% in availability. The resulting methodology is applicable to any environment as long as a correct and thorough phase of risk assessment is carried out.