Metodología para seleccionar políticas de seguridad informática en un establecimiento de educación superior

Abstract

The selection and implementation of computer security policies is sometimes difficult when an adequate procedure is not in place nor used. An additional problem to this situation is that rarely we possess historical data, such as computer audits, as to determine the current situation and the maturity degree of computer security at higher education institutions. The present study attempted to develop a methodology to collect data that permit the determination of the current situation of computer security in the Department of Information and Communication Technologies (DTIC) of the University of Cuenca. The Delphi method was applied to consult experts if all the controls of the NTE INEN-ISO/IEC 27002:2009 Ecuadorian Technical Standard were used as basis for the elaboration of questionnaires. The questionnaires allowed to identify the vulnerabilities and prioritize security controls and permitted to select the specific IT security policies needed to be implemented in the DTIC. The obtained results demonstrate that there are few computer security policies in place, and in addition they are defined in very general terms within the institution. Further, the study revealed that an adequate review and verification of compliance is not performed.