Evaluación de riesgos para un sistema de gestión de seguridad de la información en base a la Norma ISO/IEC 27001 aplicado a un proveedor de servicios de internet

Abstract

Cybercrime is a constant threat to individuals and organizations worldwide, as it utilizes exposed techniques to steal confidential information, damage systems, and cause significant financial and reputational harm. The importance of cybersecurity is evident in the wake of the COVID-19 pandemic, as cybercriminals seek new ways to exploit vulnerabilities in systems and networks. One of the primary concerns is protecting sensitive data of companies and users. In today's digital age, it is crucial to safeguard against cyber threats and attacks, secure information, and ensure the integrity of systems and critical infrastructure. In the case of an ISP, Risk Assessment is important due to the critical nature of the data they handle. Risks may include unauthorized access to user information, data loss, online fraud, and damage to the organization's reputation. This assessment is comprehensive, considering factors such as confidentiality, integrity, and availability of information, as well as risks associated with processes and technology used based on the ISO/IEC 27001 standard. Since an ISP manages large amounts of customer and user data, it provides a framework for the establishment, implementation, maintenance, and continuous improvement against threats, vulnerability assessment, and the likelihood of occurrence for each risk, along with mitigation measures. Through Open Source technology, information assets are identified, and the evaluation of threats and vulnerabilities to which they are exposed is conducted. Additionally, the potential impact of a threat on the company is determined. With this information, appropriate information security measures are implemented to mitigate the identified risks.