Desarrollo de una metodología para la gestión de incidentes en seguridad informática con aplicación de la ISO 27001 y protocolos NIST para el Hospital María
Loading...
Date
2025-07-01
Journal Title
Journal ISSN
Volume Title
Publisher
Universidad Tecnológica Centroamericana UNITEC
Abstract
Este trabajo tuvo como finalidad desarrollar una metodología para la gestión de incidentes de seguridad informática en el Hospital María, tomando como base las normas ISO 27001, ISO 27035 y el marco de ciberseguridad NIST. El estudio se enfocó en mejorar la protección de los datos clínicos y garantizar la continuidad de los servicios médicos ante posibles ciberataques. Se utilizó un enfoque mixto, con alcance descriptivo y explicativo. La población incluyó a 7 colaboradores del área técnica y administrativa en tecnologías de la información. Se aplicaron instrumentos como encuestas con escala Likert, entrevistas, análisis FODA y matriz de riesgos para identificar vulnerabilidades, evaluar el nivel de preparación institucional y conocer el grado de conocimiento del personal sobre normativa y protocolos. Los resultados mostraron que, aunque existe cierta familiaridad con estándares internacionales, no hay políticas claras ni procedimientos establecidos para responder ante incidentes. Además, se detectaron limitaciones en recursos tecnológicos y formación del personal. A partir de estos hallazgos, se propuso una metodología estructurada y adaptada al contexto del hospital, dividida en fases de prevención, detección, respuesta, recuperación y mejora continua, con énfasis en la capacitación del personal y la formalización de procesos de seguridad.
The purpose of this study was to develop a methodology for managing cybersecurity incidents at María Hospital, based on ISO 27001 and ISO 27035 standards and the NIST cybersecurity framework. The study focused on improving the protection of clinical data and ensuring the continuity of medical services in the face of potential cyberattacks. A mixed-method approach was used, with a descriptive and explanatory scope. The sample included seven collaborators from the technical and administrative areas of information technology. Instruments such as Likert-scale surveys, interviews, SWOT analyses, and risk matrices were used to identify vulnerabilities, assess the level of institutional preparedness, and determine staff knowledge of regulations and protocols. The results showed that, although there is some familiarity with international standards, there are no clear policies or established procedures for responding to incidents. Furthermore, limitations in technological resources and staff training were detected. Based on these findings, a structured methodology adapted to the hospital context was proposed, divided into phases of prevention, detection, response, recovery, and continuous improvement, with an emphasis on staff training and the formalization of safety processes.
The purpose of this study was to develop a methodology for managing cybersecurity incidents at María Hospital, based on ISO 27001 and ISO 27035 standards and the NIST cybersecurity framework. The study focused on improving the protection of clinical data and ensuring the continuity of medical services in the face of potential cyberattacks. A mixed-method approach was used, with a descriptive and explanatory scope. The sample included seven collaborators from the technical and administrative areas of information technology. Instruments such as Likert-scale surveys, interviews, SWOT analyses, and risk matrices were used to identify vulnerabilities, assess the level of institutional preparedness, and determine staff knowledge of regulations and protocols. The results showed that, although there is some familiarity with international standards, there are no clear policies or established procedures for responding to incidents. Furthermore, limitations in technological resources and staff training were detected. Based on these findings, a structured methodology adapted to the hospital context was proposed, divided into phases of prevention, detection, response, recovery, and continuous improvement, with an emphasis on staff training and the formalization of safety processes.
Keywords
Datos sensibles, Implementación, Incidente de seguridad informática, Metodología