ANÁLISIS DE ESTRATEGIAS DE GESTIÓN DE SEGURIDAD INFORMÁTICA CON BASE EN LA METODOLOGÍA OPEN SOURCE SECURITY TESTING METHODOLOGY MANUAL (OSSTMM) PARA LA INTRANET DE UNA INSTITUCIÓN DE EDUCACIÓN SUPERIOR

Abstract

The present study focused on taking as reference the OSSTMM methodology to apply an auditory of a computer security, and to identify security breaches in a Higher Education Institution, using as a type of test the ethical Hacking. Through a field investigation, it was established the current situation of policies of the computer security management of the Higher Education Institution which is the object of the study, where the main information assets analyzed were: the server with the financial and academic management system, computer labs, teaching rooms and the administrative area. Based on the audit that was done, it was found that the institution of higher superior doesn’t carry an adequate control of information security, policies and their application, obtaining as main finding the values of risk assessment (Rav) equivalent to 72.15% of security. In the computer security analysis carried out, it is concluded that the porosity and limitations allow to evaluate the level of impact and criticality of the vulnerabilities found, which can be mitigated by applying computer security management strategies and in conjunction with increased controls the Rav's valuation can be improved to a weighting of 77.00%; in this way, the reliability, integrity and availability of the information is guaranteed.