Propuesta metodológica para la gestión de riesgos de seguridad de la información del sistema de información fénix de la clínica Bonnadona prevenir
Cargando...
Fecha
2020
Autores
Salgado Castro, Camilo Andrés
Caballero Villamil, Brian Benjamín
Llano Álvarez, Jeison José
Título de la revista
ISSN de la revista
Título del volumen
Editor
Ediciones Universidad Simón Bolívar
Facultad de Ingenierías
Facultad de Ingenierías
Resumen
La mala gestión de riesgos asociados a la seguridad de la información ha propiciado una
generación de cambios tanto en herramientas tecnológicas, recursos humanos, y otros agentes
que son de gran impacto en la Organización Clínica Bonnadona. Este documento se centra en
desarrollar una metodología para la gestión de riesgos de seguridad de la información del
software Fénix, basados en la articulación de marcos de trabajo como Cobit 5, las normativas
ISO 27001 y la norma técnica ISO/IEC 27005, y el estándar para la seguridad de las aplicaciones
Web (OWASP). Teniendo en cuenta lo anterior, se busca proteger en primera instancia el activo
más importante que tiene la organización que es la información tanto del cliente interno como el
externo.
El desarrollo e implementación de proyectos de software para las entidades del sector
salud, debe llevar consigo el complimiento del conjunto de normativas legales que surgen de la
necesidad de proteger el activo de información que posee la organización. En 2012 el gobierno
nacional mediante la ley 1581, regula el derecho fundamental de Habeas Data con la finalidad
de proteger los datos personales registrados en cualquier base de datos que permita realizar
operaciones como recolección, almacenamiento, uso y tratamiento por parte de las entidades de
naturaleza pública y/o privada (COLOMBIA, 2012).
la organización debe fijar reglas de protección, medios de control y una regulación
concreta para el manejo y tratamiento de los datos personales tanto del cliente interno como el
externo, lo cual se convierte en unos de los principales riesgos a tratar y evaluar de forma
constante, por lo tanto, obliga potencialmente a la organización a tener un modelo consistente de
identificación, gestión, evaluación y tratamiento de los riesgos asociados al software Fénix.
The mismanagement of risks associated with information security has led to a generation of changes both in technological tools, human resources, and other agents that have a great impact on the Bonnadona Clinical Organization. This document focuses on developing a methodology for the management of information security risks of the “Fénix” software, based on the joint of frameworks such as Cobit 5, the ISO 27001 regulations and the ISO / IEC 27005 technical standard, and the standard for Web Application Security (OWASP). Considering the above, it seeks to protect in the first instance the most important asset that the organization has, which is the information of both the internal and external clients. The development and implementation of software projects for entities in the health sector must carry with it compliance with the set of legal regulations that arise from the need to protect the information asset owned by the organization. In 2012 the national government through law 1581, regulated the fundamental right of Habeas Data in order to protect personal data registered in any database that allows operations such as collection, storage, use and treatment by entities of nature public and / or private (COLOMBIA, 2012). The organization must establish protection rules, means of control and a specific regulation for the handling and processing of personal data of both the internal and external clients, which becomes one of the main risks to be dealt with and constantly evaluated, therefore, it potentially forces the organization to have a consistent model for the identification, management, evaluation, and treatment of the risks associated with the “Fénix” software.
The mismanagement of risks associated with information security has led to a generation of changes both in technological tools, human resources, and other agents that have a great impact on the Bonnadona Clinical Organization. This document focuses on developing a methodology for the management of information security risks of the “Fénix” software, based on the joint of frameworks such as Cobit 5, the ISO 27001 regulations and the ISO / IEC 27005 technical standard, and the standard for Web Application Security (OWASP). Considering the above, it seeks to protect in the first instance the most important asset that the organization has, which is the information of both the internal and external clients. The development and implementation of software projects for entities in the health sector must carry with it compliance with the set of legal regulations that arise from the need to protect the information asset owned by the organization. In 2012 the national government through law 1581, regulated the fundamental right of Habeas Data in order to protect personal data registered in any database that allows operations such as collection, storage, use and treatment by entities of nature public and / or private (COLOMBIA, 2012). The organization must establish protection rules, means of control and a specific regulation for the handling and processing of personal data of both the internal and external clients, which becomes one of the main risks to be dealt with and constantly evaluated, therefore, it potentially forces the organization to have a consistent model for the identification, management, evaluation, and treatment of the risks associated with the “Fénix” software.
Descripción
Palabras clave
Cobit, Metodología, ISO 27001, NTC ISO/IEC 27005, Owasp, Bonnadona, Organización, Gestión de riesgos, Paciente, Software Fénix, Análisis de riesgos, Instrumento, Análisis, Cobit, Methodology, ISO 27001, NTC ISO, IEC 27005, Owasp, Bonnadona, Organization, Risk Management, Management, Patient, Fénix Software, Instrumen, Analysis, Risk Analysis