PLANEACIÓN DE LA SEGURIDAD DE LA INFORMACIÓN CORPORATIVA SENSIBLE CONTRA AMENAZAS INTERNAS

Abstract

All companies need to protect sensitive business information in order to avoid data leakage commited by employees. However, many companies in the medium and small enterprise do not have guides or frameworks about information security that are easy to implement for IT Managers and the staff. In many cases the enterprises do not have specialized staff to fulfill this task. The implementation of information security standards such as ISO / IEC 27001:2005, are aimed at companies with a technological infrastructure, and an extensive list of employees in the IT and security departments. This kind of standards are complicated to be implemented in small and medium enterprises. This document develops a scheme as a guide to implement the protection of sensitive business information. The scheme has a defined series of steps, as shown in Figure 22, with supporting documents for each step. This document try to give an idea to the IT staff that do not have a good knowlegde about standarts of information security such as ISO/IEC 27001:2005. The document focuses on evaluating employees or human resources that use and manage sensitive information in the enterprise. The proposed scheme is based on the Deming Cycle developed by ISO / IEC 27001:2005. Also this document use MAGERIT as the methodology for risk analysis in the enterprise. Additionally this document incorporates a group of documents to guide to the IT Managers through every step of the proposed scheme.