Publication: El análisis de riesgos dentro de una auditoría informática : pasos y posibles metodologías
Loading...
Identifiers
Publication date
2013-01
Defense date
2013-01-14
Authors
Advisors
Tutors
Journal Title
Journal ISSN
Volume Title
Publisher
Impact
Export
Abstract
El presente trabajo se ha estructurado fundamentalmente en dos partes bien diferenciadas. La primera parte comprende desde el capítulo II hasta el capítulo VI y la segunda parte incluye los capítulos VII, VIII y IX. En la primera parte se ha llevado a cabo un estudio teórico sobre las áreas de conocimiento que están involucradas en este trabajo, es decir, sobre la auditoría informática y el análisis de riesgos. Para ello hemos recurrido a los trabajos publicados por varios autores de reconocido prestigio que nos han permitido estudiar diferentes tipos y modelos de auditoría para diferentes campos de la informática, así como presentar una primera aproximación metodológica al desarrollo de una auditoría. Así mismo, hemos realizado un estudio de las principales metodologías, normas y marcos de trabajo existentes en el campo de la Auditoría de Sistemas de Información; hemos repasado la familia ISO 2700 (incluyendo la ISO 27001, la 27002, la 27004 y la 27007), la ISO/IEC 38500, las normas de auditoría de ISACA, ITIL y por supuesto el marco COBIT. Con relación al análisis de riesgos, hemos seguido un desarrollo similar al expresado anteriormente para la auditoría. Primero hemos planteado un estudio teórico sobre el concepto de análisis y gestión del riesgo, para a continuación llevar a cabo un estudio de las diferentes metodologías y estándares existentes en el mercado para llevar a cabo un análisis de riesgos. Nos hemos centrado en las siguientes: AS/NZS ISO 31000:2009, UNE 71504:2008, OCTAVE, ISO/IEC 27005:2011, MEHARI, CRAMM y, por supuesto, MAGERIT, que luego hemos utilizado como base en nuestra propuesta metodológica como más adelante explicaremos. Lo anteriormente expuesto formaría lo que hemos denominado marco teórico de trabajo. A continuación expondremos la segunda parte o propuesta de metodología propia para llevar a cabo una auditoría informática utilizando un análisis de riesgos. Para ello, lo primero que hemos realizado ha sido unos análisis comparativos de los estándares, marcos de trabajo y guías y normas de la auditoría informática, por una parte y, por otra parte, un análisis comparativo de estándares y metodologías de análisis de riesgos. Finalmente, hemos realizado una propuesta metodológica para llevar a cabo una auditoría soportada en el análisis de riesgos, que entendemos susceptible de ser utilizado en entidades pequeñas y medianas. Hemos completado dicha propuesta con unas plantillas en Excel y una página web que podrá servir de mecanismo rápido de consulta para el auditor. __________________________________________________________________________________________________________________________
This work has been structured mainly in two different parts. The first part covers from chapter II to chapter VI and the second part includes chapters VII, VIII and IX. In the first part, a theoretical study has been carried out on the areas of knowledge that are involved in this work, i.e., on the information technology audit and risk analysis. For this purpose we have resorted to papers published by several renowned authors which have enabled us to study different types and models of audit for different fields of computer science, as well as presenting a first methodological approach to the development of an audit. Likewise, we have carried out a study of the main methodologies, standards and frameworks existing in the field of the information systems audit: we have reviewed the ISO 2700 family (including ISO 27001, 27002, 27004 and 27007), ISO/IEC 38500, the auditing standards of ISACA, ITIL and, of course, the COBIT framework. Regarding risk analysis, we have followed a similar development to the one explained previously for the audit. We have first planned a theoretical study on the concept of risk management and analysis, then carried out a research of the different methodologies and standards existing in the market to carry out a risk analysis. We have focused on the following: AS/NZS ISO 31000: 2009, UNE 71504: 2008, OCTAVE, ISO/IEC 27005: 2011, MEHARI, CRAMM and, of course, MAGERIT, that then we have used as a base in our methodological proposal, as explained later. The above would be what we call theoretical framework. Then, we will expose the second part or proposal of methodology to carry out an information technology audit using a risk analysis. To do this, we have made several comparative analyses of standards, frameworks and guides and computer auditing standards on the one hand and, on the other hand, a comparative analysis of standards and risk analysis methodologies. We have finally made a methodological proposal to carry out an audit based on risk analysis, which we believe that can be used in small and medium-sized entities. We have completed the proposal with a few Excel templates and a web page that can serve as a quick reference for the auditor.
This work has been structured mainly in two different parts. The first part covers from chapter II to chapter VI and the second part includes chapters VII, VIII and IX. In the first part, a theoretical study has been carried out on the areas of knowledge that are involved in this work, i.e., on the information technology audit and risk analysis. For this purpose we have resorted to papers published by several renowned authors which have enabled us to study different types and models of audit for different fields of computer science, as well as presenting a first methodological approach to the development of an audit. Likewise, we have carried out a study of the main methodologies, standards and frameworks existing in the field of the information systems audit: we have reviewed the ISO 2700 family (including ISO 27001, 27002, 27004 and 27007), ISO/IEC 38500, the auditing standards of ISACA, ITIL and, of course, the COBIT framework. Regarding risk analysis, we have followed a similar development to the one explained previously for the audit. We have first planned a theoretical study on the concept of risk management and analysis, then carried out a research of the different methodologies and standards existing in the market to carry out a risk analysis. We have focused on the following: AS/NZS ISO 31000: 2009, UNE 71504: 2008, OCTAVE, ISO/IEC 27005: 2011, MEHARI, CRAMM and, of course, MAGERIT, that then we have used as a base in our methodological proposal, as explained later. The above would be what we call theoretical framework. Then, we will expose the second part or proposal of methodology to carry out an information technology audit using a risk analysis. To do this, we have made several comparative analyses of standards, frameworks and guides and computer auditing standards on the one hand and, on the other hand, a comparative analysis of standards and risk analysis methodologies. We have finally made a methodological proposal to carry out an audit based on risk analysis, which we believe that can be used in small and medium-sized entities. We have completed the proposal with a few Excel templates and a web page that can serve as a quick reference for the auditor.
Description
Keywords
Auditoría informática, Análisis de riesgos