IT assets: a benchmark in the characterization of IT risk management processes
Main Article Content
Abstract
Assessing and managing the risks associated with IT assets is one of the most challenging tasks facing an organization today. There is an environment marked by daily pressures on time and resources, which often do not receive your full attention. However, one essential activity should include frequent reporting of new vulnerabilities, hacking attacks, and data breaches. Thus, asset management is required as a process that allows achieving adequate management of IT assets with a view to improving the efficiency and performance of the organization and thereby minimizing costs, among other things. This paper presents a theoretical review that allows us to answer how is IT asset management pertinent and indispensable in technology risk management processes? For this, exploratory and descriptive research methodologies were articulated. The literature review methodology proposed in the PRISMA Declaration was followed, consulted in the SCOPUS and IEEE Xplore Digital databases with descriptors in Spanish and English, whose date is between 2018 and 2020. It is finally proposed, that from From the review in general, the fact that there is little research that relates to IT assets and risk management. When referring to IT assets, they were linked to financial risks, which are not linked for the purposes of the investigation.
Downloads
Article Details
COPYRIGHT NOTICE
Authors who publish in the INNOVA Research Journal keeps copyright and guarantee the journal the right to be the first publication of the work under the Creative Commons License, Attribution-Non-Commercial 4.0 International (CC BY-NC 4.0). They can be copied, used, disseminated, transmitted and publicly exhibited, provided that: a) the authorship and original source of their publication (magazine, publisher, URL and DOI of the work) is cited; b) are not used for commercial purposes; c) the existence and specifications of this license of use are mentioned.
References
Almeida, F., Carvalho, I., & Cruz, F. (2019). Structure and Challenges of a Security Policy on Small and Medium Enterprises. KSII Transactions on Internet and Information Systems(747-763). doi:DOI: 10.3837/tiis.2018.02.012
Alvarado-Zabala, J., Pacheco-Guzmán, J., & Martillo-Alchundia, I. (2018). El análisis y gestión de riesgos en gobiernos de ti desde el enfoque de la metodología MAGERIT. Revista Contribuciones a las Ciencias Sociales. Obtenido de https://www.eumed.net/rev/cccss/2018/11/gestion-riesgos-magerit.html
Arcilla-Cobián, M., San Feliu Gilabert, T., Feliz, A., & Calvo-Manzano Villalón, J. A. (2017). Implementación de una biblioteca de activos de proceso orientada a la gestión de la capacidad de servicios de TI. International Journal of Information Systems and Software Engineering for Big Companies, (IJISEBC), 4(2), 43-51.
Calvo, M. A. (2002). Metodología de investigación: la formulación del problema y la búsqueda bibliográfica. Salud y Cuidados.
Cañaveral Vargas, C., & Heredia, D. (2017). Desarrollo de una metodología para correlacionar técnicas de análisis en confiabilidad con los ciclos de vida y la gestión de activos. (U. T. Pereira, Ed.) Pereira. Obtenido de https://core.ac.uk/download/pdf/92123454.pdf
Española, R. A. (2020). Real Academia Española. Obtenido de https://www.rae.es/
Gonzales E., J. (2018). Sistema automatizado de gestión de activos de TI basado en la norma ISO/IEC 19770-3:2017. Tesis. Obtenido de http://repositorio.uwiener.edu.pe/handle/123456789/2499
Haji, Sami, & Tan, Q. S. (2019). A Hybrid Model for Information Security Risk Assessment. International Journal of Advanced Trends in Computer Science and Engineering, 8(1.1), 100 - 1.
doi:https://doi.org/10.30534/ijatcse/2019/1981.12019
Halima, I. K., & Shareeful, I. (2019). Assets focus risk management framework for critical infrastructure cybersecurity risk management. IET Cyber-Physical Systems: Theory & Applications, 4(1), 332-340. doi:10.1049/iet-cps.2018.5079
Izuakor, C., & White, R. (2016). CRITICAL INFRASTRUCTURE ASSET IDENTIFICATION: POLICY, METHODOLOGY AND GAP ANALYSIS. En M. Rice, & S. Shenoi, CRITICAL INFRASTRUCTURE PROTECTION X (págs. 27–41). doi:DOI: 10.1007/978-3-319-48737-3 2
Karabacaka, B., & Sogukpinar, I. (2005). ISRAM: information security risk analysis method. Computers & Security, 24, 147-159. Obtenido de https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.476.9691&rep=rep1&type=pdf
Kitchenham, B., & Charters, S. (2007). Guidelines for performing Systematic Literature Reviews in Software Engineering. Obtenido de https://userpages.uni-koblenz.de/~laemmel/esecourse/slides/slr.pdf
Kure, H. I., & Islam, S. (2019). Assets focus risk management framework for critical infrastructure cybersecurity risk management. IET Cyber-Physical Systems: Theory & Applications, 4(4), 332-340. doi:doi: 10.1049/iet-cps.2018.5079
Lateef, A., & Omotayo, F. (2019). Information audit as an important tool in organizational management: A review of literature. Business Information Review, 36(1), 15-22. doi:https://doi.org/10.1177/0266382119831458
Liberati, A., Altman, D. G., Tetzlaff, J., Mulrow, C., Gøtzsche, P. C., Ioannidis, J. P., . . . Moher, D. (2009). The PRISMA Statement for Reporting Systematic Reviews and Meta-Analyses of Studies That Evaluate Health Care Interventions: Explanation and Elaboration. PLOS MEDICINE, 6(7), 1-28. doi:https://doi.org/10.1371/journal.pmed.1000100
Mackita, M., S. S.-Y., & Choe, T.-Y. (2019). ERMOCTAVE: A risk management framework for IT systems which adopt cloud computing. Future Internet, 11(9). doi:10.3390/fi11090195
Management, T. I. (2015). Asset Management An Anatomy. Version 3. United. Obtenido de https://theiam.org/media/1781/iam_anatomy_ver3_web.pdf
Martins, L. (2014). Software asset management in an organization. Instituto Universitario de Lisboa (ISCTE-IUL. Obtenido de http://hdl.handle.net/10071/11184
Medina Villarreal, M. I., Cantuca Blandón, W. A., & Bautista León, F. L. (2018). IMPLEMENTACION DE METODOLOGIA PARA LA GESTION DE ACTIVOS APLICADA A LA EMPRESA IMCO SOLUCIONES SAS. Colombia. Obtenido de http://35.227.45.16/bitstream/handle/20.500.12277/4130/00004398.pdf?sequence=1&isAllowed=y
Normalización, O. I. (2018). Information security risk. Obtenido de https://www.iso.org/standard/75281.html?browse=tc
Pallas, G., & Corti, M. E. (2009). Metodología de Implantación de un SGSI en un grupo empresarial jerárquico. Montevideo. Obtenido de http://www.criptored.upm.es/cibsi/cibsi2009/docs/Papers/CIBSI-Dia2-Sesion3(4).pdf
Pathirana, A., Radhakrishnan, M., Bevaart, M., Voost, E., Mahasneh, S., & Rob, H. A. (2018). Fit-for-Purpose Infrastructure Asset Management Framework for Water Utilities Facing High Uncertainties. Infrastructures,. MDPI AG. Obtenido de http://dx.doi.org/10.3390/infrastructures3040055
Posner, E. (1972). Archives in the Ancient World. Cambridge/ Massachusetts. Obtenido de http://files.archivists.org/pubs/free/ArchivesInTheAncientWorld-2003.pdf
Ramírez, A., & Ortiz, Z. (2011). Gestión de Riesgos tecnológicos basada en ISO 31000 e ISO 27005 y su aporte a la continuidad de negocios. Revista en ingeniería, 16(2), 56-66. Obtenido de https://dialnet.unirioja.es/servlet/articulo?codigo=4797252
Rodríguez S., O., & Colina V., A. (2018). Propuesta tecnológica para la gestión eficiente del servicio médico de una universidad ecuatoriana. . Revista Espacios, 50. Obtenido de https://www.revistaespacios.com/a18v39n50/18395009.html
Saeidi, P. S. (2020). The influence of enterprise risk management on firm performance with the moderating effect of intellectual capital dimensions. Economic Research-Ekonomska Istrazivanja. doi:doi:10.1080/1331677X.2020.1776140
Salcedo-Muñoz, V., Quezada Abad, C., Núñez, L., Varela-Veliz, G., Novillo, E., & Viteri, C. (2017). Bienestar estudiantil universitario en Ecuador: Caso unidades de bienestar estudiantil en las universidades de la provincia de El Oro. Revista Espacios. Obtenido de https://www.revistaespacios.com/a17v38n30/a17v38n30p17.pdf
Solarte, F., Enriquez, E., & Benavidez, M. (2015). Metodología de análisis y evaluación de riesgos aplicados a la seguridad informática y de información bajo la norma ISO/IEC 27001. Revista Tecnológica ESPOL, 492-507. Obtenido de http://www.rte.espol.edu.ec/index.php/tecnologica/article/view/456
Stoll, M., Felderer, M., & Breu, R. (2010). Information management for holistic, collaborative information security manageme. 6th International Joint Conference on Computer, Information, and Systems Sciences, and Engineering, CISSE 2010, (págs. 211-224).
Urrutia, G., & Bonfill, X. (2010). Declaración PRISMA: una propuesta para mejorar la publicación de revisiones. Medicina Clínica, 135(11), 505-511. Obtenido de http://www.laalamedilla.org/Investigacion/Recursos/PRISMA%20Spanish%20Sept%202010.pdf
Valencia Duque, F. J., & Orozco Alzate, M. (2017). Metodología para la implementación de un Sistema de Gestión de Seguridad de la Información basado en la familia de normas ISO/IEC 27000. RISTI - Revista Ibérica de Sistemas e Tecnologias de Informação, 22, 73-88. doi: https://dx.doi.org/10.17013/risti.22.73-88
Vanegas D., G. A., & Pardo, C. J. (2014). Hacia un modelo para la gestión de riesgos de TI en. Revista S&T, 12(30), 35-48. doi:10.18046/syt.v12i30.1860
Villafranca, D., Sánchez, L. E., Fernández-Medina, E., & Piattini, M. (2005). La norma ISO/IEC 17799 como base para Gestionar la Seguridad de la Información. Tercer Taller de Seguridad en Ingeniería del Software y Bases de Datos (JISBD05), (págs. Pp. 13-21). Granada.
Yazar, Z. (2011). A Qualitative Risk Analysis and Management Tool – CRAMM. SANS Institute InfoSec.