Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution

This research was carried out to generate an implementation plan for the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis at the IUB university institution. The connotation of security has been extended over time due to technological adva...

Full description

Autores:
Hernandez Collante, Leonel
Pranolo, Andri
Prasetya Wibawa, Aji
Tipo de recurso:
Article of journal
Fecha de publicación:
2024
Institución:
Universidad Tecnológica de Bolívar
Repositorio:
Repositorio Institucional UTB
Idioma:
eng
OAI Identifier:
oai:repositorio.utb.edu.co:20.500.12585/13551
Acceso en línea:
https://doi.org/10.32397/tesea.vol5.n2.635
Palabra clave:
Implementation
Security
Information
Risk
Analysis
ISMS
Rights
openAccess
License
Leonel Hernandez Collante, Andri Pranolo, Aji Prasetya Wibawa - 2024
id UTB2_78e6b02daa07d941a362eb4160064bc9
oai_identifier_str oai:repositorio.utb.edu.co:20.500.12585/13551
network_acronym_str UTB2
network_name_str Repositorio Institucional UTB
repository_id_str
dc.title.spa.fl_str_mv Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution
dc.title.translated.spa.fl_str_mv Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution
title Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution
spellingShingle Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution
Implementation
Security
Information
Risk
Analysis
ISMS
title_short Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution
title_full Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution
title_fullStr Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution
title_full_unstemmed Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution
title_sort Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution
dc.creator.fl_str_mv Hernandez Collante, Leonel
Pranolo, Andri
Prasetya Wibawa, Aji
dc.contributor.author.eng.fl_str_mv Hernandez Collante, Leonel
Pranolo, Andri
Prasetya Wibawa, Aji
dc.subject.eng.fl_str_mv Implementation
Security
Information
Risk
Analysis
ISMS
topic Implementation
Security
Information
Risk
Analysis
ISMS
description This research was carried out to generate an implementation plan for the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis at the IUB university institution. The connotation of security has been extended over time due to technological advances and the introduction of new information systems, which simultaneously generate new security challenges. Likewise, the instruments to guarantee the confidentiality, integrity, and availability of information have become a fundamental strategy to ensure the security of public and private organizations. The preparation of this plan includes the methodological cycle, where they indicate a series of phases and their corresponding activities to implement the ISMS ISO 27001:2013, with procedural characteristics that support the entire implementation process from beginning to end, facilitating due process and continuity. Likewise, an analysis of the Information security risk plan is carried out, of which there is significant progress. The result of this cycle will be a plan with a schedule of activities so that the organization links all the personnel around compliance with the standard, raising awareness regarding the importance of information security and the development of activities in phases that, within the stipulated times, will be able to have the ISMS fully operational
publishDate 2024
dc.date.accessioned.none.fl_str_mv 2024-12-24 00:00:00
dc.date.available.none.fl_str_mv 2024-12-24 00:00:00
dc.date.issued.none.fl_str_mv 2024-12-24
dc.type.spa.fl_str_mv Artículo de revista
dc.type.coar.fl_str_mv http://purl.org/coar/resource_type/c_2df8fbb1
dc.type.driver.eng.fl_str_mv info:eu-repo/semantics/article
dc.type.coar.eng.fl_str_mv http://purl.org/coar/resource_type/c_6501
dc.type.local.eng.fl_str_mv Journal article
dc.type.content.eng.fl_str_mv Text
dc.type.version.eng.fl_str_mv info:eu-repo/semantics/publishedVersion
dc.type.coarversion.eng.fl_str_mv http://purl.org/coar/version/c_970fb48d4fbd8a85
format http://purl.org/coar/resource_type/c_6501
status_str publishedVersion
dc.identifier.url.none.fl_str_mv https://doi.org/10.32397/tesea.vol5.n2.635
dc.identifier.doi.none.fl_str_mv 10.32397/tesea.vol5.n2.635
dc.identifier.eissn.none.fl_str_mv 2745-0120
url https://doi.org/10.32397/tesea.vol5.n2.635
identifier_str_mv 10.32397/tesea.vol5.n2.635
2745-0120
dc.language.iso.eng.fl_str_mv eng
language eng
dc.relation.references.eng.fl_str_mv Luis Enrique. El gasto mundial en TI crecerá un 8% en 2024 según Gartner, Feb 2024. [2] Giovanna Culot, Guido Nassimbeni, Matteo Podrecca, and Marco Sartor. The ISO/IEC 27001 information security management standard: literature review and theory-based research agenda. The TQM Journal, 33(7):76–105, Mar 2021. [3] Yasmin Kamil, Sofia Lund, and M Sirajul Islam. Information security objectives and the output legitimacy of iso/iec 27001: stakeholders’ perspective on expectations in private organizations in sweden. Information Systems and e-Business Management, 21(3):699–722, Aug 2023. [4] Lukas Grenefalk and NorénWallin. Security management: Investigating the challenges and success factors in implementation and maintenance of information security management systems, 2023. [5] Heru Susanto, Mohammad Nabil Almunawar, and Yong Chee Tuan. Information security challenge and breaches: novelty approach on measuring iso 27001 readiness level. International Journal of Engineering and Technology, 2(1):67–75, 2012. [6] Carol Hsu, Tawei Wang, and Ang Lu. The Impact of ISO 27001 Certification on Firm Performance. Jan 2016. [7] ISO 27001 - Certificado ISO 27001 punto por punto - Presupuesto Online., 2017. [8] Jangirala Srinivas, Ashok Kumar Das, and Neeraj Kumar. Government regulations in cyber security: Framework, standards and recommendations. Future Generation Computer Systems, 92:178–188, Oct 2018. [9] Universidad del Atlántico. Sistema de gestión de seguridad de la información - universidad del atlántico, July 2024. Accessed: 2024-07-07. [10] Gestion Web. La UPTC, única universidad pública latinoamericana que ha conseguido la ISO 20000 y 2700, Apr 2016. [11] Mosquera C. Resolución Rectoral Creación SGSI Universidad Distrital Francisco Jose De Caldas. 2015. [12] KPMG. CIO Survey 2018: Insights for technology leaders in Colombia, June 2018. Accessed: 2023-07-07. [13] La Ciberseguridad en el Día Internacional de la Seguridad de la Información - 30 de noviembre 2022, 2022. [14] Universidad del Rosario. Ciberataques en colombia ¿está colombia preparada para uno?, July 2024. Accessed: 2024-07-07. [15] Ivanti. Ciso priorities shift: Navigating changes post-pandemic, July 2024. Accessed: 2024-07-07. [16] O. R. Martínez. Marco para el Gobierno de la Seguridad de la Información en servicios Cloud Computing. PhD thesis, Universidad de Castilla - La Mancha, 2014. [Online]. [17] J. D. Camargo Ramirez. Diseño de un sistema de gestión de la seguridad de la información (SGSI) en el área tecnológica de la comisión nacional del servicio civil - CNSC basado en la norma ISO27000 e ISO27001, 2017. [Online]. [18] J. A. Guaman Seis. Diseño de un Sistema de Gestión de Seguridad de la Información para Instituciones Militares. PhD thesis, Escuela Politécnica Nacional, Quito, 2015. [19] Erick Guerra, Harold Neira, Jorge L. Díaz, and Janns Patiño. Desarrollo de un sistema de gestión para la seguridad de la información basado en metodología de identificación y análisis de riesgo en bibliotecas universitarias. Información tecnológica, 32(5):145–156, Oct 2021. [20] F. Becerra and A. Villamil. Diseño de procedimientos de gestión de usuarios y gestión del cambio en el sistema kactus-hr aplicando iso 27001. Master’s thesis, Universidad Distrital Francisco Jose de Caldas, 2019. [21] B. Gambin and L. Carreño. Marco de trabajo para la gestión de la seguridad de los sistemas de información en la universidad pública colombiana - caso de estudio universidad del magdalena. Master’s thesis, Universidad del Norte, 2017. [22] R. Betancourt, P. Monroy, and J. Davila. Implementación de sistemas de control de la información en el sena regional tolima, 2015. [Online]. [23] R. Aguirre and A. Zambrano. Estudio Para La Implementación Del Sistema De Gestión De Seguridad De La Información Para La Secretaría De Educación Departamental De Nariño Basado En La Norma ISO/IEC 27001, 2015. [Online]. [24] Jorge Merchan-Lima, Fabian Astudillo-Salinas, Luis Tello-Oquendo, Franklin Sanchez, Gabriel Lopez-Fonseca, and Dorys Quiroz. Information security management frameworks and strategies in higher education institutions: a systematic review. Annals of Telecommunications, 76(3-4):255–270, Jul 2020. [25] Antonio Fernández, Beatriz Gómez, Kleona Binjaku, and Elinda Kajo Meçe. Digital transformation initiatives in higher education institutions: A multivocal literature review. Education and Information Technologies, 28(10):12351–12382, Mar 2023. [26] L. A. Mutchler and M. Hines. Effective practices in implementing isms in higher education: A case study. Education and Information Technologies, 2018. [27] J. El-Khoury and C. Kesserwan. Digital transformation and it governance in higher education: A case study. International Journal of Education and Development Using Information and Communication Technology, 2018. [28] N. Ismail and A. N. Zainab. Implementation of information security management system framework in public universities. Journal of Information Systems Research and Innovation, 2018. [29] F. A. Aloul and S. Zhioua. Compliance challenges for isms in higher education. Journal of Information Security and Applications, 2020. [30] G. Tarekegn. Information security management in higher education institutions in developing countries. Journal of Information Security, 2019. [31] O. A. Fonseca-Herrera, A. E. Rojas, and H. Florez. A model of an information security management system based on ntc-iso/iec 27001 standard. IAENG International Journal of Computer Science, 48(2):1–10, 2021. [32] Pangondian Prederikus, Stefan Gendita Bunawan, Ford Lumban Gaol, Tokuro Matsuo, and Andi Nugroho. Standard analysis of document control as information according to iso 27001 2013 in pt xyz. Lecture Notes in Networks and Systems, page 721–732, 2022. [33] Rúsbel Domínguez-Domínguez, Omar A Flores-Laguna, and del Valle-López. Evaluation of an information security management system at a mexican higher education institution, 2023. [34] Zaydi Mounia and Nassereddine Bouchaib. A new comprehensive solution to handle information security governance in organizations. Proceedings of the 2nd International Conference on Networking, Information Systems Security, page 1–5, Mar 2019. [35] Adrian Ellison. How to prepare and protect your institution against a future cybersecurity attack, July 2024. Accessed: 2024-07-08. [36] BSI Case Study Fredrickson International. How fredrickson has reduced third party scrutiny and protected its reputation with iso 27001 certification, 2024. [Online]. [37] Inprosec. Caso de Éxito: Adaptación a la ISO 27001 (Gradiant) - Inprosec, July 2024. Accessed: 2024-07-09. [38] A Aguilar, T Velásquez Pérez, and Silva. Information security model. case study higher education institution. Journal of Physics Conference Series, 1257(1):012014–012014, Jun 2019. [39] Ehsan Samiei and Jafar Habibi. Toward a Comprehensive IT Management Methodology. IEEE Engineering Management Review, 50(1):168–185, Dec 2021. [40] Felipe Andrés Corredor-Chavarro, Diana Cristina Franco-Mora, and Diego Izquierdo-Dussan. Implementation of cybersecurity risk analysis systems in colombia. Visión electrónica, 2(2):334–342, Dec 2019.
dc.relation.ispartofjournal.eng.fl_str_mv Transactions on Energy Systems and Engineering Applications
dc.relation.citationvolume.eng.fl_str_mv 5
dc.relation.citationstartpage.none.fl_str_mv 1
dc.relation.citationendpage.none.fl_str_mv 20
dc.relation.bitstream.none.fl_str_mv https://revistas.utb.edu.co/tesea/article/download/635/429
dc.relation.citationedition.eng.fl_str_mv Núm. 2 , Año 2024 : Transactions on Energy Systems and Engineering Applications
dc.relation.citationissue.eng.fl_str_mv 2
dc.rights.eng.fl_str_mv Leonel Hernandez Collante, Andri Pranolo, Aji Prasetya Wibawa - 2024
dc.rights.uri.eng.fl_str_mv https://creativecommons.org/licenses/by/4.0
dc.rights.accessrights.eng.fl_str_mv info:eu-repo/semantics/openAccess
dc.rights.creativecommons.eng.fl_str_mv This work is licensed under a Creative Commons Attribution 4.0 International License.
dc.rights.coar.eng.fl_str_mv http://purl.org/coar/access_right/c_abf2
rights_invalid_str_mv Leonel Hernandez Collante, Andri Pranolo, Aji Prasetya Wibawa - 2024
https://creativecommons.org/licenses/by/4.0
This work is licensed under a Creative Commons Attribution 4.0 International License.
http://purl.org/coar/access_right/c_abf2
eu_rights_str_mv openAccess
dc.format.mimetype.eng.fl_str_mv application/pdf
dc.publisher.eng.fl_str_mv Universidad Tecnológica de Bolívar
dc.source.eng.fl_str_mv https://revistas.utb.edu.co/tesea/article/view/635
institution Universidad Tecnológica de Bolívar
repository.name.fl_str_mv Repositorio Digital Universidad Tecnológica de Bolívar
repository.mail.fl_str_mv bdigital@metabiblioteca.com
_version_ 1858228436701544448
spelling Hernandez Collante, LeonelPranolo, AndriPrasetya Wibawa, Aji2024-12-24 00:00:002024-12-24 00:00:002024-12-24This research was carried out to generate an implementation plan for the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis at the IUB university institution. The connotation of security has been extended over time due to technological advances and the introduction of new information systems, which simultaneously generate new security challenges. Likewise, the instruments to guarantee the confidentiality, integrity, and availability of information have become a fundamental strategy to ensure the security of public and private organizations. The preparation of this plan includes the methodological cycle, where they indicate a series of phases and their corresponding activities to implement the ISMS ISO 27001:2013, with procedural characteristics that support the entire implementation process from beginning to end, facilitating due process and continuity. Likewise, an analysis of the Information security risk plan is carried out, of which there is significant progress. The result of this cycle will be a plan with a schedule of activities so that the organization links all the personnel around compliance with the standard, raising awareness regarding the importance of information security and the development of activities in phases that, within the stipulated times, will be able to have the ISMS fully operationalapplication/pdfengUniversidad Tecnológica de BolívarLeonel Hernandez Collante, Andri Pranolo, Aji Prasetya Wibawa - 2024https://creativecommons.org/licenses/by/4.0info:eu-repo/semantics/openAccessThis work is licensed under a Creative Commons Attribution 4.0 International License.http://purl.org/coar/access_right/c_abf2https://revistas.utb.edu.co/tesea/article/view/635ImplementationSecurityInformationRiskAnalysisISMSImplementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institutionImplementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institutionArtículo de revistainfo:eu-repo/semantics/articlehttp://purl.org/coar/resource_type/c_6501http://purl.org/coar/resource_type/c_2df8fbb1Journal articleTextinfo:eu-repo/semantics/publishedVersionhttp://purl.org/coar/version/c_970fb48d4fbd8a85https://doi.org/10.32397/tesea.vol5.n2.63510.32397/tesea.vol5.n2.6352745-0120Luis Enrique. El gasto mundial en TI crecerá un 8% en 2024 según Gartner, Feb 2024. [2] Giovanna Culot, Guido Nassimbeni, Matteo Podrecca, and Marco Sartor. The ISO/IEC 27001 information security management standard: literature review and theory-based research agenda. The TQM Journal, 33(7):76–105, Mar 2021. [3] Yasmin Kamil, Sofia Lund, and M Sirajul Islam. Information security objectives and the output legitimacy of iso/iec 27001: stakeholders’ perspective on expectations in private organizations in sweden. Information Systems and e-Business Management, 21(3):699–722, Aug 2023. [4] Lukas Grenefalk and NorénWallin. Security management: Investigating the challenges and success factors in implementation and maintenance of information security management systems, 2023. [5] Heru Susanto, Mohammad Nabil Almunawar, and Yong Chee Tuan. Information security challenge and breaches: novelty approach on measuring iso 27001 readiness level. International Journal of Engineering and Technology, 2(1):67–75, 2012. [6] Carol Hsu, Tawei Wang, and Ang Lu. The Impact of ISO 27001 Certification on Firm Performance. Jan 2016. [7] ISO 27001 - Certificado ISO 27001 punto por punto - Presupuesto Online., 2017. [8] Jangirala Srinivas, Ashok Kumar Das, and Neeraj Kumar. Government regulations in cyber security: Framework, standards and recommendations. Future Generation Computer Systems, 92:178–188, Oct 2018. [9] Universidad del Atlántico. Sistema de gestión de seguridad de la información - universidad del atlántico, July 2024. Accessed: 2024-07-07. [10] Gestion Web. La UPTC, única universidad pública latinoamericana que ha conseguido la ISO 20000 y 2700, Apr 2016. [11] Mosquera C. Resolución Rectoral Creación SGSI Universidad Distrital Francisco Jose De Caldas. 2015. [12] KPMG. CIO Survey 2018: Insights for technology leaders in Colombia, June 2018. Accessed: 2023-07-07. [13] La Ciberseguridad en el Día Internacional de la Seguridad de la Información - 30 de noviembre 2022, 2022. [14] Universidad del Rosario. Ciberataques en colombia ¿está colombia preparada para uno?, July 2024. Accessed: 2024-07-07. [15] Ivanti. Ciso priorities shift: Navigating changes post-pandemic, July 2024. Accessed: 2024-07-07. [16] O. R. Martínez. Marco para el Gobierno de la Seguridad de la Información en servicios Cloud Computing. PhD thesis, Universidad de Castilla - La Mancha, 2014. [Online]. [17] J. D. Camargo Ramirez. Diseño de un sistema de gestión de la seguridad de la información (SGSI) en el área tecnológica de la comisión nacional del servicio civil - CNSC basado en la norma ISO27000 e ISO27001, 2017. [Online]. [18] J. A. Guaman Seis. Diseño de un Sistema de Gestión de Seguridad de la Información para Instituciones Militares. PhD thesis, Escuela Politécnica Nacional, Quito, 2015. [19] Erick Guerra, Harold Neira, Jorge L. Díaz, and Janns Patiño. Desarrollo de un sistema de gestión para la seguridad de la información basado en metodología de identificación y análisis de riesgo en bibliotecas universitarias. Información tecnológica, 32(5):145–156, Oct 2021. [20] F. Becerra and A. Villamil. Diseño de procedimientos de gestión de usuarios y gestión del cambio en el sistema kactus-hr aplicando iso 27001. Master’s thesis, Universidad Distrital Francisco Jose de Caldas, 2019. [21] B. Gambin and L. Carreño. Marco de trabajo para la gestión de la seguridad de los sistemas de información en la universidad pública colombiana - caso de estudio universidad del magdalena. Master’s thesis, Universidad del Norte, 2017. [22] R. Betancourt, P. Monroy, and J. Davila. Implementación de sistemas de control de la información en el sena regional tolima, 2015. [Online]. [23] R. Aguirre and A. Zambrano. Estudio Para La Implementación Del Sistema De Gestión De Seguridad De La Información Para La Secretaría De Educación Departamental De Nariño Basado En La Norma ISO/IEC 27001, 2015. [Online]. [24] Jorge Merchan-Lima, Fabian Astudillo-Salinas, Luis Tello-Oquendo, Franklin Sanchez, Gabriel Lopez-Fonseca, and Dorys Quiroz. Information security management frameworks and strategies in higher education institutions: a systematic review. Annals of Telecommunications, 76(3-4):255–270, Jul 2020. [25] Antonio Fernández, Beatriz Gómez, Kleona Binjaku, and Elinda Kajo Meçe. Digital transformation initiatives in higher education institutions: A multivocal literature review. Education and Information Technologies, 28(10):12351–12382, Mar 2023. [26] L. A. Mutchler and M. Hines. Effective practices in implementing isms in higher education: A case study. Education and Information Technologies, 2018. [27] J. El-Khoury and C. Kesserwan. Digital transformation and it governance in higher education: A case study. International Journal of Education and Development Using Information and Communication Technology, 2018. [28] N. Ismail and A. N. Zainab. Implementation of information security management system framework in public universities. Journal of Information Systems Research and Innovation, 2018. [29] F. A. Aloul and S. Zhioua. Compliance challenges for isms in higher education. Journal of Information Security and Applications, 2020. [30] G. Tarekegn. Information security management in higher education institutions in developing countries. Journal of Information Security, 2019. [31] O. A. Fonseca-Herrera, A. E. Rojas, and H. Florez. A model of an information security management system based on ntc-iso/iec 27001 standard. IAENG International Journal of Computer Science, 48(2):1–10, 2021. [32] Pangondian Prederikus, Stefan Gendita Bunawan, Ford Lumban Gaol, Tokuro Matsuo, and Andi Nugroho. Standard analysis of document control as information according to iso 27001 2013 in pt xyz. Lecture Notes in Networks and Systems, page 721–732, 2022. [33] Rúsbel Domínguez-Domínguez, Omar A Flores-Laguna, and del Valle-López. Evaluation of an information security management system at a mexican higher education institution, 2023. [34] Zaydi Mounia and Nassereddine Bouchaib. A new comprehensive solution to handle information security governance in organizations. Proceedings of the 2nd International Conference on Networking, Information Systems Security, page 1–5, Mar 2019. [35] Adrian Ellison. How to prepare and protect your institution against a future cybersecurity attack, July 2024. Accessed: 2024-07-08. [36] BSI Case Study Fredrickson International. How fredrickson has reduced third party scrutiny and protected its reputation with iso 27001 certification, 2024. [Online]. [37] Inprosec. Caso de Éxito: Adaptación a la ISO 27001 (Gradiant) - Inprosec, July 2024. Accessed: 2024-07-09. [38] A Aguilar, T Velásquez Pérez, and Silva. Information security model. case study higher education institution. Journal of Physics Conference Series, 1257(1):012014–012014, Jun 2019. [39] Ehsan Samiei and Jafar Habibi. Toward a Comprehensive IT Management Methodology. IEEE Engineering Management Review, 50(1):168–185, Dec 2021. [40] Felipe Andrés Corredor-Chavarro, Diana Cristina Franco-Mora, and Diego Izquierdo-Dussan. Implementation of cybersecurity risk analysis systems in colombia. Visión electrónica, 2(2):334–342, Dec 2019.Transactions on Energy Systems and Engineering Applications5120https://revistas.utb.edu.co/tesea/article/download/635/429Núm. 2 , Año 2024 : Transactions on Energy Systems and Engineering Applications220.500.12585/13551oai:repositorio.utb.edu.co:20.500.12585/135512025-09-16 09:15:15.57https://creativecommons.org/licenses/by/4.0Leonel Hernandez Collante, Andri Pranolo, Aji Prasetya Wibawa - 2024metadata.onlyhttps://repositorio.utb.edu.coRepositorio Digital Universidad Tecnológica de Bolívarbdigital@metabiblioteca.com