Mitigación de riesgos de ataques cibernéticos para la empresa M&M Servitel S.A.C.
Fecha
Título de la revista
ISSN de la revista
Título del volumen
Editor
Pontificia Universidad Católica del Perú
Acceso al texto completo solo para la Comunidad PUCP
Resumen
La presente tesis propone la implementación de un Sistema de Gestión de Seguridad
de la Información (SGSI), basado en la norma ISO/IEC 27001, para la empresa M&M
Servitel S.A.C., con el objetivo de mitigar riesgos de ciberseguridad y garantizar la
continuidad operativa. Un diagnóstico estratégico reveló vulnerabilidades significativas,
especialmente tras un ataque de ransomware que detuvo las operaciones por 72 horas,
generando pérdidas económicas y afectando la confianza de los clientes.
Ante esta problemática, se evaluaron dos alternativas: tercerizar la seguridad o
implementar un SGSI propio. Se optó por esta última por su mayor alineación estratégica y
capacidad de fortalecer el control interno. La propuesta contempla políticas, procedimientos y
controles alineados a ISO/IEC 27001, incluyendo análisis de riesgos, formación de un equipo
CSIRT, auditorías internas y un plan de capacitación.
La implementación se desarrollará en tres años e incluye cronograma, presupuesto de
S/ 266,000.00 (40% inversión propia y 60% financiamiento externo) y factores críticos de
éxito, como el liderazgo directivo y el compromiso del personal. Se estima que el nivel de
cobertura de seguridad alcanzará el 84%, el tiempo de recuperación se reducirá a 12 horas y
el cumplimiento normativo llegará al 85%. Financieramente, el proyecto es viable: presenta
un VAN de S/ 62,556.88, una TIR de 32.11% y un ROSI del 21.44%. En conclusión, se
demuestra que el SGSI es una solución técnica, estratégica y económicamente sustentable
para M&M Servitel S.A.C.
This thesis proposes the implementation of an Information Security Management System (ISMS), based on the ISO/IEC 27001 standard, for the company M&M Servitel S.A.C., with the goal of mitigating cybersecurity risks and ensuring operational continuity. A strategic assessment revealed significant vulnerabilities, especially following a ransomware attack that halted operations for 72 hours, resulting in financial losses and damaging customer trust. In response to this issue, two alternatives were evaluated: outsourcing security services or implementing an in-house ISMS. The latter was chosen due to its stronger strategic alignment and its potential to enhance internal control. The proposed solution includes policies, procedures, and controls aligned with ISO/IEC 27001, including risk analysis, the formation of a CSIRT team, internal audits, and a training plan. The implementation will take place over three years and includes a timeline, budget a budget of S/ 266,000.00 (40% Own investment and 60% external financing), and critical success factors such as executive leadership and staff commitment. It is estimated that the security coverage level will reach 84%, recovery time will be reduced to 12 hours, and regulatory compliance will achieve 85%. Financially, the project is viable: it shows a Net Present Value (NPV) of S/ 62,556.88, an Internal Rate of Return (IRR) of 32.11%, and a Return on Security Investment (ROSI) of 21.44%. In conclusion, the ISMS is shown to be a technically, strategically, and economically sustainable solution for M&M Servitel S.A.C.
This thesis proposes the implementation of an Information Security Management System (ISMS), based on the ISO/IEC 27001 standard, for the company M&M Servitel S.A.C., with the goal of mitigating cybersecurity risks and ensuring operational continuity. A strategic assessment revealed significant vulnerabilities, especially following a ransomware attack that halted operations for 72 hours, resulting in financial losses and damaging customer trust. In response to this issue, two alternatives were evaluated: outsourcing security services or implementing an in-house ISMS. The latter was chosen due to its stronger strategic alignment and its potential to enhance internal control. The proposed solution includes policies, procedures, and controls aligned with ISO/IEC 27001, including risk analysis, the formation of a CSIRT team, internal audits, and a training plan. The implementation will take place over three years and includes a timeline, budget a budget of S/ 266,000.00 (40% Own investment and 60% external financing), and critical success factors such as executive leadership and staff commitment. It is estimated that the security coverage level will reach 84%, recovery time will be reduced to 12 hours, and regulatory compliance will achieve 85%. Financially, the project is viable: it shows a Net Present Value (NPV) of S/ 62,556.88, an Internal Rate of Return (IRR) of 32.11%, and a Return on Security Investment (ROSI) of 21.44%. In conclusion, the ISMS is shown to be a technically, strategically, and economically sustainable solution for M&M Servitel S.A.C.
Descripción
Palabras clave
Empresas--Medidas de seguridad, Tecnología de la información