Sistema de gestión de la seguridad de la información (SGSI) basado en la norma ISO 27001:2013 para el centro médico 'Cotacachi'
No Thumbnail Available
Date
2023
Journal Title
Journal ISSN
Volume Title
Publisher
PUCE - Ibarra
Abstract
El presente trabajo aborda la implementación de un Sistema de Gestión de la Seguridad de la Información (SGSI) en el Centro Médico 'Cotacachi', con el propósito de salvaguardar la confidencialidad, integridad y disponibilidad de la información sensible y crítica relacionada con los pacientes y las operaciones médicas. La norma ISO 27001:2013 se adopta como marco de referencia para guiar la planificación, establecimiento, implementación, operación, monitoreo, revisión, mantenimiento y mejora del SGSI. La tesis se estructura en varias etapas clave. En primer lugar, se realiza una revisión exhaustiva de la norma ISO 27001:2013, identificando sus requisitos y directrices para el establecimiento de un SGSI efectivo. Luego, se lleva a cabo un análisis detallado de la situación actual del Centro Médico 'Cotacachi' en cuanto a la seguridad de la información, identificando vulnerabilidades, amenazas y riesgos potenciales. Basándose en este análisis, se procede a diseñar un plan detallado de implementación del SGSI, que incluye la definición de políticas de seguridad, la identificación de roles y responsabilidades, la realización de evaluaciones de riesgos y la definición de medidas de control adecuadas para mitigar dichos riesgos. Además, se establece un programa de concientización y capacitación en seguridad de la información para el personal del centro médico. Durante la fase de implementación, se integran los controles de seguridad necesarios, se establecen procedimientos operativos y se realiza una auditoría interna para asegurar que el SGSI cumple con los requisitos de la norma ISO 27001:2013. Finalmente, se lleva a cabo una revisión exhaustiva del proceso de implementación, se identifican lecciones aprendidas y se proponen recomendaciones para la mejora continua del SGSI en el Centro Médico 'Cotacachi'.
This thesis addresses the implementation of an Information Security Management System (ISMS) at Cotacachi Medical Center, with the aim of safeguarding the confidentiality, integrity, and availability of sensitive and critical information related to patients and medical operations. The ISO 27001:2013 standard is adopted as a framework to guide the planning, establishment, implementation, operation, monitoring, review, maintenance, and improvement of the ISMS. The thesis is structured into several key stages. Firstly, a comprehensive review of the ISO 27001:2013 standard is conducted, identifying its requirements and guidelines for establishing an effective ISMS. Subsequently, a detailed analysis of the current state of Cotacachi Medical Center's information security is performed, identifying vulnerabilities, threats, and potential risks. Based on this analysis, a detailed ISMS implementation plan is designed. This plan includes defining security policies, identifying roles and responsibilities, conducting risk assessments, and defining appropriate control measures to mitigate identified risks. Additionally, an information security awareness and training program is established for the medical center's personnel. During the implementation phase, necessary security controls are integrated, operational procedures are established, and an internal audit is conducted to ensure that the ISMS complies with the ISO 27001:2013 requirements. Finally, a thorough review of the implementation process is carried out, lessons learned are identified, and recommendations for the continuous improvement of the ISMS at Cotacachi Medical Center are proposed.
This thesis addresses the implementation of an Information Security Management System (ISMS) at Cotacachi Medical Center, with the aim of safeguarding the confidentiality, integrity, and availability of sensitive and critical information related to patients and medical operations. The ISO 27001:2013 standard is adopted as a framework to guide the planning, establishment, implementation, operation, monitoring, review, maintenance, and improvement of the ISMS. The thesis is structured into several key stages. Firstly, a comprehensive review of the ISO 27001:2013 standard is conducted, identifying its requirements and guidelines for establishing an effective ISMS. Subsequently, a detailed analysis of the current state of Cotacachi Medical Center's information security is performed, identifying vulnerabilities, threats, and potential risks. Based on this analysis, a detailed ISMS implementation plan is designed. This plan includes defining security policies, identifying roles and responsibilities, conducting risk assessments, and defining appropriate control measures to mitigate identified risks. Additionally, an information security awareness and training program is established for the medical center's personnel. During the implementation phase, necessary security controls are integrated, operational procedures are established, and an internal audit is conducted to ensure that the ISMS complies with the ISO 27001:2013 requirements. Finally, a thorough review of the implementation process is carried out, lessons learned are identified, and recommendations for the continuous improvement of the ISMS at Cotacachi Medical Center are proposed.
Description
Keywords
Confidencialidad, Integridad, Datos, Disponibilidad, Gestión, Incidentes, Seguridad, Evaluación, Riesgos, Continuidad, Negocio, Proceso, Certificación, Mejora continua