Proposta de um Modelo para Auxílio na Gestão de Riscos da Informação – Integrando Métodos e Normas

Abstract

Information is considered a valuable asset for companies, and is subject to different types of threats. Aiming at preserving confidentiality, integrity and availability, information security protects the organization’s information or data assets. To ensure this protection and avoid incidents, it is necessary to adopt risk management practices that ensure business continuity, minimize risk and maximize return on investment. However, existing norms and standards for risk management suggest practices that are not very clear, which makes their implementation in companies difficult. As a way to identify, in a simplified way, the threats that may put the organization’s assets at risk, this work proposed the study and creation of a model for the analysis of potential risks based on norms and international reference standards. This work has results, including: creation and validation of a new risk analysis model and its automation, named ARION, hosted on a server of the Information Security Research Group of the Federal University of Pampa. The software can be accessed through the address: https://arion.gsi.seg.br/. ARION has passed tests and gained good acceptance among users.