Brecha de conocimiento en la gestión de riesgos de seguridad de la información para el área administrativa en el sector farmacéutico hondureño: estudio de caso en distribuidora Leterago y laboratorio Megalabs 2025
No Thumbnail Available
Date
2026-02-01
Journal Title
Journal ISSN
Volume Title
Publisher
Universidad Tecnológica Centroamericana UNITEC
Abstract
Esta investigación examina la brecha de conocimiento en la gestión de riesgos de seguridad de la información en la filial hondureña de Distribuidora Leterago (grupo Megalabs), un actor relevante y con gran presencia en el sector farmacéutico latinoamericano, nuestro propósito es estimar el impacto de esta brecha y su relación en la exposición a vulnerabilidades y en la eficiencia operativa. El estudio parte de un diagnóstico situacional que evidencia vacíos estructurales y normativos, así como la ausencia de un modelo formal y estandarizado de gestión de riesgos alineado con marcos internacionales, lo que limita la identificación, evaluación y tratamiento sistemático de riesgos y se traduce en tiempos de respuesta prolongados y mayor exposición a amenazas como el phishing. En consecuencia, se plantea una investigación aplicada bajo diseño exploratorio y estudio de caso único, que combina estrategias de triangulación: una matriz de competencias basada en ISO 27005 para medir el conocimiento del personal de TI; encuestas a líderes y personal administrativo; y análisis documental de políticas e incidentes. El plan de análisis incorpora indicadores operativos, como ser el Tiempo Medio de Respuesta (MTTR), sobre incidentes de los últimos doce meses, con el fin de vincular la brecha de conocimiento con resultados de desempeño. El marco teórico contextualiza el caso mediante un análisis macro (PESTEL) y micro del entorno y fundamenta la necesidad de gobernanza y mejora continua en seguridad de la información. Con este enfoque, la investigación persigue cuantificar la brecha de habilidades y prácticas frente a ISO 27005; analizar factores culturales y de política que la perpetúan; y generar un diagnóstico base que oriente estrategias de mitigación durante el cuarto trimestre de 2025. La contribución esperada comprende lineamientos de implementación y priorización que articulen competencias, procesos y tecnología con estándares de referencia, reforzando la gobernanza de TI y la resiliencia operativa en el contexto farmacéutico hondureño.
This research examines the knowledge gap in Information Security (InfoSec) risk management at the Honduran subsidiary of Distribuidora Leterago (Megalabs group), a major player with a significant presence in the Latin American pharmaceutical sector. Our aim is to estimate the impact of this gap and its relationship to exposure to vulnerabilities and operational efficiency. The study is based on a situational diagnosis that reveals structural and regulatory gaps, as well as the absence of a formal and standardized risk management model aligned with international frameworks, which limits the identification, assessment, and systematic treatment of information risks and results in prolonged response times and greater exposure to threats such as phishing. Consequently, an applied research project is proposed, based on an exploratory design and a particular case study, combining triangulation strategies: a competency matrix based on ISO 27005 to measure the knowledge of IT staff; surveys of leaders and administrative staff; and documentary analysis of policies and incidents. The analysis plan incorporates operational indicators, such as the Mean Time to Respond (MTTR), for incidents over the last twelve months, to link the knowledge gap with performance results. The theoretical framework contextualizes the case through a macro (PESTEL) and micro analysis of the environment and substantiates the need for governance and continuous improvement in information security. With this approach, the research seeks to quantify the skills and practices gap compared to ISO 27005; analyze cultural and policy factors that perpetuate it; and generate a baseline diagnosis to guide mitigation strategies during the fourth quarter of 2025. The expected contribution includes implementation and prioritization guidelines that articulate competencies, processes, and technology with reference standards, reinforcing IT governance and operational resilience in the Honduran pharmaceutical context.
This research examines the knowledge gap in Information Security (InfoSec) risk management at the Honduran subsidiary of Distribuidora Leterago (Megalabs group), a major player with a significant presence in the Latin American pharmaceutical sector. Our aim is to estimate the impact of this gap and its relationship to exposure to vulnerabilities and operational efficiency. The study is based on a situational diagnosis that reveals structural and regulatory gaps, as well as the absence of a formal and standardized risk management model aligned with international frameworks, which limits the identification, assessment, and systematic treatment of information risks and results in prolonged response times and greater exposure to threats such as phishing. Consequently, an applied research project is proposed, based on an exploratory design and a particular case study, combining triangulation strategies: a competency matrix based on ISO 27005 to measure the knowledge of IT staff; surveys of leaders and administrative staff; and documentary analysis of policies and incidents. The analysis plan incorporates operational indicators, such as the Mean Time to Respond (MTTR), for incidents over the last twelve months, to link the knowledge gap with performance results. The theoretical framework contextualizes the case through a macro (PESTEL) and micro analysis of the environment and substantiates the need for governance and continuous improvement in information security. With this approach, the research seeks to quantify the skills and practices gap compared to ISO 27005; analyze cultural and policy factors that perpetuate it; and generate a baseline diagnosis to guide mitigation strategies during the fourth quarter of 2025. The expected contribution includes implementation and prioritization guidelines that articulate competencies, processes, and technology with reference standards, reinforcing IT governance and operational resilience in the Honduran pharmaceutical context.
Keywords
Gestión de riesgos de seguridad de la información, Seguridad de la información, ISO 27005, MTTR, Farmacéutico, Honduras