ANÁLISIS DE LLAVES DE CIFRADO AUTOMÁTICOS PARA ENTIDADES FINANCIERAS DEL ECUADOR

Abstract

This article analyzes the life cycle of ATM encryption keys for financial entities in Ecuador, with the aim of presenting recommendations on the operating processes involved. The national standard for operational risk JB-2014-3066 of the Banking Board of Ecuador, and the international standard PCI DSS, were used as a basis to prepare a survey on the analysis of the life cycle of encryption keys. The financial entities evaluated decided to keep their commercial names in reserve. The personnel surveyed correspond to risk departments, operation of ATMs, security and information technologies. It was identified that the most critical vulnerability is found in the training of personnel in the departments of operation of ATMs, risk and information security. It has been determined as an opportunity for improvement, to evaluate the loss of confidentiality of the encryption keys, and its impact on the economy and reputation of financial entities. It is concluded, based on the regulations, that financial entities comply with minimum security requirements for the life cycle of encryption keys, however, lack of staff training, the constant evolution of technologies, and low level of security. commitment of senior management, generate new risks. One factor that was not analyzed in this study is the financial performance of a financial institution and its influence on the investment in security of the life cycle of ATM encryption keys.