Estudio de las normativas de seguridad de la información de instituciones públicas: propuesta de una normativa en una institución de educación superior.

Abstract

The objective was to recognize the changes in the Department of Technology and Communication (DTIC) of the Escuela Superior Politécnica de Chimborazo in the face of a proposal of information security controls. A study of a proposal of international standards was carried out, which can be adapted to the Ecuadorian laws in force in recent years in the field of information security with the aim of improving the integrity, availability and confidentiality of the data handled a computer center of a higher education institution. The proposal is designed to be applied to the DTIC of the Escuela Superior Politécnica de Chimborazo. When the initial information was collected, it turned out that its main problem is not having a strategic information security plan. Therefore, the department's management sees the need to adopt a proposal with policies and regulations in force in Ecuador that will help to improve its level of information security based on an international ISO 27001 standard and its 11 domains that allow high-impact processes to be created in the DTIC. Thus, guaranteeing the users of the higher institution that their data is duly treated under indicators of quality as integrity, reliability and availability. The implementation of the proposal in some of its most critical processes gives the DTIC management a 60% improvement in information security. It is recommended to promote research on these issues to encourage the use of regulations and laws in force in our country in institutions of higher education.