Gestión, Implementación y Control de los riesgos relacionados con la tecnología de la información en los Bancos
Archivos
Fecha
2012-11-28
Autores
Título de la revista
ISSN de la revista
Título del volumen
Editor
Facultad de Ciencia Económicas y Estadísticaca - Universidad Nacional de Rosario
Resumen
La información es un recurso muy importante dentro de los activos de una organización, tiene un valor determinado de acuerdo al grado de criticidad que posea, por consiguiente debe ser debidamente protegida tanto interna como externamente. La seguridad de la información resguarda a la “información” de una amplia gama de amenazas, a fin de garantizar la continuidad del negocio, minimizar el daño al mismo y maximizar el retorno sobre las inversiones y las oportunidades.
La seguridad de la información se logra implementando un conjunto adecuado de controles, que abarcan políticas, prácticas, procedimientos, estructuras organizacionales y funciones del software.
Se deben establecer estos controles para garantizar que se logren los objetivos específicos de seguridad de la organización.
Con el advenimiento de las nuevas Tecnologías Informáticas y de Comunicación (TIC), la operatoria bancaria se hizo aún más riesgosa porque al utilizar medios electrónicos para la captura, procesamiento de los datos y transmisión de la información es necesario contar con medidas adecuadas a los tiempos que corren para asegurar los tres principios básicos de seguridad: confidencialidad, integridad y disponibilidad de la información.
Por todo lo expresado anteriormente y siendo el B.C.R.A. el ente regulador de la actividad financiera y supervisor de las Entidades Financieras (EF), propone ampliar la normativa vigente sobre Seguridad de la Información, actualizarla y detallar con claridad los requisitos mínimos en cuanto a la gestión, implementación y control de los riesgos relacionados con Tecnología Informática, Sistemas de Información y Recursos Asociados con el fin de que las EF implementen las mejores prácticas de control y seguridad, teniendo en cuenta el riesgo de dicha actividad, la criticidad de sus activos y la adopción de la Normativa Internacional vigente.
Information is a very important resource of the assets of an organization. Its value is determined by the degree of critical relevance and therefore it should be properly protected both internally and externally. Protection of information safeguards "information" from a wide range of threats in order to ensure business continuity, minimize self damage and maximize return on investment and opportunities. Protection of information is achieved by implementing a suitable set of controls, which include policies, practices, procedures, organizational structures and software functions. These controls should be established to ensure that they achieve the specific objectives of the organization's security. With the advent of new Information Technology and Communication (ITC), banking operations became even more risky because using electronic means to capture, data processing and transmission of information is necessary to have appropriate measures in time running to secure the three basic principles of security: confidentiality, integrity and availability of information. Given that the Central Bank of Argentina (Banco Central de la República Argentina) regulates financial activity and supervises Financial Institutions (FI), it seeks to increase existing rules on information security. It also seeks to update and clearly detail the minimum requirements for management , implementation and control of risks associated with Information Technology, Information Systems and Resources Associated with the FI to implement the best practices of control and security, taking into account the risk of that activity, the criticality of assets and adoption of international guidelines.
Information is a very important resource of the assets of an organization. Its value is determined by the degree of critical relevance and therefore it should be properly protected both internally and externally. Protection of information safeguards "information" from a wide range of threats in order to ensure business continuity, minimize self damage and maximize return on investment and opportunities. Protection of information is achieved by implementing a suitable set of controls, which include policies, practices, procedures, organizational structures and software functions. These controls should be established to ensure that they achieve the specific objectives of the organization's security. With the advent of new Information Technology and Communication (ITC), banking operations became even more risky because using electronic means to capture, data processing and transmission of information is necessary to have appropriate measures in time running to secure the three basic principles of security: confidentiality, integrity and availability of information. Given that the Central Bank of Argentina (Banco Central de la República Argentina) regulates financial activity and supervises Financial Institutions (FI), it seeks to increase existing rules on information security. It also seeks to update and clearly detail the minimum requirements for management , implementation and control of risks associated with Information Technology, Information Systems and Resources Associated with the FI to implement the best practices of control and security, taking into account the risk of that activity, the criticality of assets and adoption of international guidelines.
Descripción
Palabras clave
Auditoría, Seguridad física, Seguridad lógica, Audit, Physical security, Logical security