Implementation of an Information Security Management System Based on the ISO/IEC 27001: 2013 Standard for the Information Technology Division

Abstract

The Information Technologies Directorate of the Micaela Bastidas de Apurímac National University (UNAMBA) (UNAMBA Rationalization Office, «Organization and Functions Manual,» Abancay, 2018.), is in charge of managing the technologies and information; it also has to safeguard the computer assets under its responsibility. However, it does not have any plan, standard, or directive that allows correctly protecting the information. For this reason, our research aimed to contribute to improving the level of information security in the Information Technology Directorate (DTI) of UNAMBA, implementing the Information Security Management System based on the standard ISO/IEC 27001: 2013 (ISO 27001 - ISO 27001 Management Systems Software, «ISO Software,» 2018. [Online]. Available: https://www.isotools.org/normas/riesgos-y-seguridad/iso-27001/. [Last access: July 21, 2018].). This standard allows the assurance of the confidentiality, availability, and integrity of information and information systems.

Regarding the research methodology, the type of research is applied with a pre-experimental research design. As a methodology for the design of the Information Security Management System, the Deming PDCA method («PDCA Cycle (Plan, Do, Check and Act): Deming's circle of continuous improvement | PDCA Home,» Pdcahome.com, 2018. [Online]. Available: https://www.pdcahome.com/5202/ciclo-pdca/. [Last access: July 25, 2018].) (Plan, Do, Check, Act) was used, which consists of identifying the computer assets, performing the analysis and risk management, to then establish response actions (controls) and mitigate the associated risks. Also, carry out information security policies. For the analysis and risk management, the MAGERIT III methodology (General Directorate for Administrative Modernization, Procedures and Promotion of Electronic Administration, MAGERIT - version 3.0. Information Systems Risk Analysis and Management Methodology., Madrid: Ministry of Finance and Public Administrations, 2012.) was used. The sample is n = 20 people.

As results, it was obtained that the level of security risks before the implementation of the controls was 86.15%, to obtain 11.15% later; therefore, there was a decrease of 75%. Likewise, there was an increase in security controls, since before carrying out the risk treatment plan, only 18 (15.78%) controls were obtained, but then it was increased to 65 (57.01%) controls, representing an increase of 41.23%. Also, there was an improvement in the level of training in information security issues in DTI users because, before the implementation of the ISMS, only 48% of the respondents had knowledge about information security, but then it rose to 95%.