Gestão de riscos de segurança da informação utilizando IS0 27005 e vulnerabilidades

Abstract

This TCC's overall objective was to present case studies of companies that have applied an ISO 27005 standard to an SGSI system and perform a vulnerability analysis following one of the available tools (in this case, used Wireshark). Regarding the methodological procedures, this research according to its nature is a summary of the subject, as for the objectives, it is exploratory. As for the technical procedures, it is a bibliographical, documental, and experimental research. The studies carried out showed that companies are protecting their information using: combination of ISO 27005 techniques with a NIST SP 800-30 revision 1. Thus, they generate a general probability scale and risk assessment that, finally, with the help of a risk identification tool, creation, from combination risks, an assessment table, and methods of solving the risks found. Some companies didn’t prioritize the SGSI in their routines, putting their system and company at risk. The studies carried out make it possible to fulfill that the ISO 27005 norm is not a standard, but a recommendation of good practices. It helps protect the information of the company or organization that enforces its security policies. Furthermore, with the implementation carried out with Wireshark, the use of vulnerability tools to diagnose problems and assess performance can be verified, enabling the taking of appropriate measures.