Diseño de un conjunto de políticas y controles para la gestión y mitigación de riesgos de seguridad informática del área de soporte técnico de una unidad de tecnología en una universidad pública de la ciudad de Guayaquil

Abstract

CONDITION FOR PUBLICATION OF PROJECT. This thesis addresses the complications in managing IT security risks in the technical support area of a public university in Guayaquil. High exposure to threats such as malware, unauthorized access, and human error was identified due to the absence of clear policies and specific controls. As a solution, a set of policies and controls based on the ISO/IEC 27001 and ISO 31000 standards was designed. Through interviews and risk analysis, critical assets were identified, vulnerabilities were assessed, and corrective measures were established according to criticality. The result is a structured proposal for preventive, detective, and corrective controls that, if implemented, would strengthen the protection of institutional information and align the university with the Organic Law on Personal Data Protection and international best practices. Keywords: IT security, Risk management, Security controls