ECU@Risk, a methodology for risk management applied to MSMEs
DOI:
https://doi.org/10.29019/enfoqueute.v8n1.140Keywords:
Risk, management, ECU@Risk, Information SecurityAbstract
Information is the most valuable element for any organization or person in this new century, which, for many companies, is a competitive advantage asset (Vásquez & Gabalán, 2015). However, despite the lack of knowledge about how to protect it properly or the complexity of international standards that indicate procedures to achieve an adequate level of protection, many organizations, especially the MSMEs sector, fails to achieve this goal.Therefore, this study proposes a methodology for information security risk management, which is applicable to the business and organizational environment of the Ecuadorian MSME sector. For this purpose, we analyze several methodologies as Magerit, CRAMM (CCTA Risk Analysis and Management Method), OCTAVE-S, Microsoft Risk Guide, COBIT 5 COSO III. These methodologies are internationally used in risk management of information; in the light of the frameworks of the industry: ISO 27001, 27002, 27005 and 31000.
Downloads
References
Calderón, D., Estrella, M., & Flores, M. (2011). Sistema de Gestión de Seguridad de la Información aplicada al área de recursos humanos de la empresa DECEVALE S.A. Guayaquil: Universidad Politécnica Salesiana.
Crespo, E. (2016). Metodología de Seguridad de la Información para la gestión del Riesgo Informático aplicable a MPYMES. Universidad de Cuenca, Cuenca.
Delgado, J. A. (2014). Ciberseguridad en Gobernanza de Internet en Ecuador: Infraestructura y acceso. Encuentro Nacional de Gobernanza de Internet, Quito, Ecuador. Quito.
García Falconí, J. (07 de 02 de 2011). Revista judicial. Obtenido de derechoecuador.com: http://www.derechoecuador.com/articulos/detalle/archive/doctrinas/derechoinformatico/2011/02/07/la-proteccion-de-datos-personales
Gómez, Á. (2011). Enciclopedia de la seguridad informática. México: Alfa-Omega.
ISACA. (2012). Un Marco de Negocio para el Gobierno y la Gestión de las TI de la Empresa. Madrid: ISACA® Framework. doi:978-1-60420-282-3
Minchala, P. (2016). Estudio comparativo de las metodologías COBIT 5 y COSO III para la gestión del riesgo de TI. Universidad del Azuay, Cuenca, Ecuador.
Muñoz, D. C. (24 de Febrero de 2012). dspace. Obtenido de space: http://dspace.ups.edu.ec/bitstream/123456789/1442/5/Capitulo%202.pdf
Superintendencia de Bancos y Seguros. (2011). Gestión integral y control de riesgos. En Normas generales para las instituciones del sistema de seguros privados (págs. 95 - 107). Quito: Superintendencia de Bancos y Seguros.
Vásquez, F., & Gabalán, J. (2015). Información y ventaja competitiva. Coexistencia exitosa en las organizaciones de vanguardia. En El profesional de la información (págs. 149-156). Ebsco.
Vásquez, S., & López, D. (14 de 03 de 2016). Estudio comparativo entre las metodologías Microsoft Secure Risk Management y Octave. Cuenca, Azuay, Ecuador.
Downloads
Published
Issue
Section
License
The authors retain all copyrights ©.
- The authors retain their trademark and patent rights, as well as rights to any process or procedure described in the article.
- The authors retain the right to share, copy, distribute, perform, and publicly communicate the article published in Enfoque UTE (for example, post it in an institutional repository or publish it in a book), provided that acknowledgment of its initial publication in Enfoque UTE is given.
- The authors retain the right to publish their work at a later date, to use the article or any part of it (for example, a compilation of their work, lecture notes, a thesis, or for a book), provided that they indicate the source of publication (authors of the work, journal, volume, issue, and date).
