EL AN\uc1LISIS DE RIESGO EN LA SEGURIDAD DE LA INFORMACI 3N (Nota T\ue9cnica)

El prop\uf3sito de este art\uedculo consiste en ofrecer un conjunto de reflexiones conceptuales sobre la seguridad de la informaci\uf3n y espec\uedficamente sobre el an\ue1lisis de riesgos y su importancia en las organizaciones. Por lo que, el recurso m\ue1s importante y afectado en toda organizaci\uf3n p\ufablica y privada, grande o peque\uf1a, es la informaci\uf3n, por lo cual toda organizaci\uf3n debe estar alerta e implementar sistemas de seguridad basados en un an\ue1lisis de riesgo para evitar o mitigar las consecuencias no deseadas. El an\ue1lisis de riesgo es un proceso que permite identificar las amenazas y vulnerabilidades de una organizaci\uf3n con el objetivo de generar controles que minimicen los efectos de los riesgos, el cual implica determinar que o cu\ue1les activos proteger, de qu\ue9 o de qui\ue9n hay que protegerlos y c\uf3mo hacerlo. El an\ue1lisis de riesgos debe realizarse de forma continua dado que es necesario evaluar peri\uf3dicamente si los riesgos identificados y la exposici\uf3n a los mismos se mantienen vigentes; y es de vital importancia porque permite identificar los impactos futuros en la estructura de riesgos de la organizaci\uf3n. Internacionalmente existe una norma, ISO 27005:2008 publicada en junio del a\uf1o 2008, que establece criterios sobre la gesti\uf3n del riesgo de la seguridad de la informaci\uf3n y proporciona un marco normalizado que sirve de gu\ueda para definir metodolog\uedas propias para cada organizaci\uf3n, esta norma sirve de apoyo a la norma ISO 27001:2005 que proporciona un modelo para establecer, implementar, operar, monitorear, revisar, mantener y mejorar un sistema de gesti\uf3n de seguridad de la informaci\uf3n (SGSI). Palabras Claves del Autor: Seguridad de informaci\uf3n, an\ue1lisis de riesgos, vulnerabilidades, amenazas. ABSTRACT Risk analysis on the information security The purpose of this paper is to provide a set of conceptual thinking on information security and specifically on risk analysis and its importance in organizations. So, the most important and affected resource in any public or private, large or small organization, is the information collected, processed, stored and made available to users on computers and transmitted over networks, so that any organization must be alert and learn to implement security systems based on a risk analysis to prevent or mitigate the unintended consequences, because the risk is measurable. Risk analysis is a process that identifies threats and vulnerabilities of an organization with the goal of creating controls that mitigate or minimize the effects of risks, that involves to determine which assets to protect, from what or from who have to be protected and how to do it. The risk analysis should be made continuously since it is necessary to assess regularly whether the identified risks and exposure to those calculated earlier are still valid, and it is of vital importance because it can allow to identify future impacts on the risk structure of the organization. Internationally there is a standard, ISO 27005:2008 published in June of 2008, which establishes criteria for risk management of information security and provides a standardized framework that provides guidance in defining its own methodologies for each organization, this rule serves support to ISO 27001:2005 which provides a model for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a management system for information security (ISMS). Keywords: Information Security, risk analysis, vulnerabilities and threats.