cibertec - seguridad y auditoría de ti 5 - 9

7/31/2019 CIBERTEC - Seguridad y Auditoría de TI 5 - 9

http://slidepdf.com/reader/full/cibertec-seguridad-y-auditoria-de-ti-5-9 1/44

C I B

E R T E C

1

!"#!$!%&!



C I B

E R T E C

2



!"#

#$ % $&'( )

' *++$

,-./0123 4156555

C I B

E R T E C

4

78 9::*''(7*8+&;

,-./0.<3 4.-6555 =>$

?@> ,-4/-003 4A46555 =>$

=7" ,-5/443 4B06555 + +'

Fuente: http://en.wikipedia.org/wiki/Big_Four_(audit_firms) , Octubre 2010



4/

&**C :$' ( %:**C & *$&3 D *E ** D

C I B

E R T E C

5

>6 ' > F*6 ' 3E% :** :** D *$&'

Fuente http://www.isaca.org/Knowledge-Center/Documents/Glossary/glossary.pdf, octubre 2010



4/$

AUDITORÍAAUDITORÍA

C I B

E R T E C

6

Asegura cumplimiento de Estándares, Directivas, Normas y/o

Procedimientos vigentes.

Identifica vulnerabilidades y riesgos.

Recomienda acciones que contribuyan con el alineamiento de

objetivos del negocio.



-/'"'

• >*(*3'6*'*'>':$*C9'*';'*%&*:*'G&&$H&>'3E%

>**$&'/''3*E$&*'/

• 3E%*'D'**'*:*'6>(&3'('>C>'3'':*C'$&/

• *'$*3* I'*' ' "

C I B

E R T E C

7

*'&'**C/

• "*'(*'3'*'>':$*C9;6'&**$&6**&>$(6''&>$(*$3&>$/

• *'&'**:'*'&*$**6%*''$J('&*$J*'/

• *'*'>':$*C'+$(&$*'*C$*G'&'(3KF'( /'*93E%'&*'>':$*C;$*$&'$'G&$'>&'"%* 6'*':%"('3E%*'&'**($*$%'*C/&$'>G*$

>&+: :$ ::* 9;6&3'>*':*G*'>':$*C'G/



-/'"'

• *'*'>':$*C'+$(&$*'*C$*G'&'(3KF'( /

• '*93E%'&*'>':$*C;$*$&'$'G&$'>&'"%* 6'*':%"('3E%*'&'**($*$%'*C/

• $' G*$ +: :$ ::*

C I B

E R T E C

8

9;6&3'>*':*G*'>':$*C'G/



-/'"'

C I B

E R T E C

9



-/'"'9";

4/ >$$&'*3:*'$3(&3'+>+$/

-/ #*'$'$&**3'*++%3%:$$*/

B/ *:>&3K&*8+*$$&*>F:::*(&/

C I B E R T E C

10

A/ 3K&*>&&*3'::*%$>$%>+/

0/ >$+3E*%>>+&*>:*/

./ +L+*+%$::$&*>3E*%/

1/ >$$&'$&&'**'$>L+:$&*>3E*%/

2/ >$$&'$3&:$*%8:(&'$':*''/



-/'"'9";

</ >$%'8++:*'$'+':&&'**'3L8/

45/ $'&&'**'3&:$*%8&>3(*$&&&'*/

44/ ::*%:$*+'>("''&&$>$M'*$&&'**'6$**>&*6$'*'+&&'*K

/

C I B E R T E C

11

4-/ ::*%&&'**'*3*'(*$:%:*'$/



C I B

E R T E C

12

"



>

C I B E R T E C

13



4/"

7'*C

N :*CE

N :*C3E%('**

N :*C*6::$*C6(3**

E**C

N $'*'

N %'*C>(H*''

N '3*C(%'*C&'&3'*'

C I B E R T E C

14

N '3*C:$

N 3*$>*(&'**C

N $C:$(*&&'3E'

>$

N :**C'*$&'$'&'**C:



"

C I B E R T E C

15

7'*C



7'*C

• :&'I

- 7- "

- 3E%

- '**

C I B E R T E C

16



"

C I B E R T E C

17

E**C



E**C

• )*!"++,,

'&$'3E*$&'*>:*DC*'H'&*6*':'F&'*'&**''$**C*'(3'%*''%'&*$&'*/

$$6C' '%D:$*C *'

C I

B E R T E C

18

&*6:**$$$'>$I3E%6#**OF6*'%$&H67*&'>(&$/'*&*C'3E%'&*&':$*C3&/



$'&*

• $'&*:**C*'I

•

•

•

C I

B E R T E C

19

• •

•



%'*C*%*'

• 2!")!*&"&3&"*/"

7%''H'*':*D'**ST'L+>+U'&*'&*/*6'**D&*C&%*&&*(+D'>$%*%'&*/

*':** %''HI

C I B E R T E C

21

N !/!*/'*'6'(*$DH6&$>'>:*/

N !/!*/ '*'$>'>H

&*'%'*C'H'*'6**'('$$:*6E*D&*$*'($D'3%*C/



'*C*%*'

• 7'%'*C'H6'*>&*%'':*%'*'6*6%:*'*'E*'(*$DH'

&*'&*%'*C/

• 7''6*'**>&&*&%'&*9$;('*$&'$'*'/$$&% '' '' $G3''%' *

C I B E R T E C

22

%C/

• %'4'7'**'$$D*'>%3'I; '05Q'$'**D&$''&*/3; 'B5Q'$'**D&*S'US$&'U'

&*/*; '-5Q'$'**D$''&*'&*/



739;

&3 & 'G > ' > $I

K &!$!* > * ' *' ** ' :*% ' *'/7 'G *$3*C * $ &3 & > ':*% ' *'/

K -2!* $ * 3 3 + *$*C '

C I B E R T E C

23

&*C *'/ 3%*C $3 P' & ' *' :*/ 3%*C6 &&* $D > ' 3 *$ & >*C/

K 5!0!* 'G & $ ' *' D 'G/ 'G '%'*C ' &3 ' 'G*C *'/ * %* & * ' *' D :* *$ &*$

3'* ( $D D * $ F ' *' :*%/9 :*C $;

K .*!0/ 7&* $E %* ' :*% *'6 ( 'G * *$3*C >*C6 3%*C ( F$ ' &3

:* > :* *' D :* :*G$/



'*C*%*'

• '$H'$3D>>I

; 7*'$D*6'P$$&3$$94C-;/3; 7*'$''P$$&3$D*3':**6*$&'E$&*'*'/

C I B E R T E C

24

*':**&%'':*%'*'IN *':**$&'$C'$45Q'$N *':*&**:*'/&$D'45Q

'$%/

N *':*'(*$+:

recuenc a ues ra(Riesgo

Medio)

ues ra(Riesgo Alto)

ues ra(Riesgo

Crítico)Anual 1 1 1

Trimestral 2 2 2

Mensual 2 3 5

Semanal 5 10 15

Diario 15 20 30

Cada vez que ocurra 20 25 30



:**C3'

• %'*C>'I

>%''*'6'*>3D%'%$'>:*::*'%'>'F/$>'>D*3&'*'$&'$&'"*/

C I B E R T E C

25

%'*C'*'&>'>:*'733'**6>$&*$3/

!"

!

!

#

# ! ! !"



"

C I B E R T E C

26



$'>

4/ *&'>

-/ >'>

B/ '$'>

A/ ''

C I B E R T E C

27



3%*

*$&3%*CI

• 'I*3$$'3%*C

• *&*CI7''''3%*C6('*>':***'/*6&DF&$$&''F '**C'3%*C/

C

I B E R T E C

28

• >I*3':*D>&>'&*'$&H

• *$*CIF&'&*C&$>'*(':*'>:*':***'/*$*3$

*':*'*'$&H6*$%'C&$('&E**C/7''6*DIC(C'$&H67'*(7*$&%67D**&%'6D*'/



3%*

• $I&*''&3'F&'*'$%&3'$&>'3%*C:*/

• 7'**CI*3'&'"*&3''&*&$>'3%*C/3%*C3*&'**C*$&''*$&$'>*&$>' ' '**'3%*C/' '**C3*

C

I B E R T E C

29

**'6**($3'6(3*'':*+(&3'$&'$*C6&&'G'&>$/



C*($C:$

• '4'C3D'*$*''6(:D&'**C*'$>'>

'*'3%*/

• ',%7*3E'*>3&&:$6'*'3&'3%*C'$3*'/

C

I B E R T E C

30



>$

• '>$'*%&$D*$&''**%''$&H6>'*$&'$'&'**C**'H

'&*/

• *$&H3'*'$*$>$(&>$*C'&'**C*/

C

I B E R T E C

31



"

C

I B E R T E C

32

7



7'*C

• *$I$!0!&!)&/6!

• -7/2>'*%'*C6&G*C6G*C$&'*C'*$3'&'**&'&*>*'*$&H6:$$G%&*:***$&'(%'$&'*C*$3G:*$&3':*&**C/

• "*!*%C*3D'>&*'>C*$3'&'**&'&*>*'54V-54451V-544I

C

I B E R T E C

33

N :*C(*$**C'&*$*$3'&'**9*'(*$3$>*;/

N %'*C6>*C&(G*C*$3'&'**/N >$'(&'*$3'&'**/N >>*C:*'&**$3'&'**/

&'***'%'*CI&'**C46&'**C-/



E**C

• 0/*0)*!*0!"&"*&"!!*/2&!&&!)&/6!• )*!"++,,

C

I B E R T E C

34



$'&*

• $'&*I• +&IVV'%B//V*W%*WV>W*$3V**&W3*/&+&

•

•

C

I B E R T E C

35

•

•

•

•



%'*C'>

C

I B E R T E C

36



%'*C*%*'

C

I B E R T E C

37



'*C*%*'

C

I B E R T E C

38



739;

&!$!*-2!*

5!0!*.*!0/

C

I B E R T E C

39

recuenc a ues ra(Riesgo

Medio)

ues ra(Riesgo Alto)

ues ra(Riesgo

Crítico)Anual 1 1 1

Trimestral 2 2 2

Mensual 2 3 5

Semanal 5 10 15

Diario 15 20 30

Cada vez que ocurra 20 25 30



:**C3'

C

I B E R T E C

40



3%*

!"

$%

#

&

#'(

)* #

)

#$%

C

I B E R T E C

41



$'>

&'

()*)

+#%, +%, #

*

+*

#-

*$

"%#

.//0/++1/+ /0/)22

3)22

C

I B E R T E C

42



C*($C:$

• '4'C3D'*$*''6(:D&'**C*'$>'>

'*'3%*/

• ',%7*3E'*>3&&:$6'*'3&'3%*C'$3*'/

C

I B E R T E C

43



>$

• '>$'*%&$D*$&''**%''$&H6>'*$&'$'&'**C**'H

'&*/

• *$&H3'*'$*$>$(&>$*C'&'**C*/

C

I B E R T E C

44