Quick Guide to an Information Security Management System for an ISP: XNET Case Study.

Abstract

Introduction:  Computer users, whether individuals or belonging to the public or private sector, have informal expectations of their computers. They expect that when they turn on the computer, the data they left the day before will be saved, that their emails will reach their recipients without loss of attachments, and that when they access the payroll database, the data will be real and consistent. However, these expectations are not always met due to possible hardware failures, email interception, or manipulation of payroll applications by dishonest employees. Objective:  The objective of this project is to create a quick guide for an information security management system, based on MAGERIT and the ISO/IEC 27000 standards, in order to analyze vulnerabilities. Methodology:  Research was carried out in reliable online sources to select the research articles, theses, and projects that were relevant to this project. A qualitative and quantitative analysis of each of the information assets was carried out, as well as a descriptive and bibliographic research of the threats found. The objective was to identify the best practices and controls necessary to prevent these threats from materializing. Results: The result was the implementation of an information security management system that allows to eliminate or minimize the probability and impact of security incidents. The MAGERIT risk methodologies and ISO/IEC 27000 standards were used. Conclusion:  In conclusion, a quick guide is presented for an Information Security Management System for an ISP. However, it is important to note that each ISP is unique and the specific conclusions may vary depending on the context.