Metodología para la prevención de riesgos en el manejo de la información personal almacenada en el sistema de información académica de la Universidad de Pamplona.

Abstract

The efficient use of information technologies has become a critical success factor for today's society. One of the most neglected aspects is the proper handling of personal information. Although academic information systems help to access the information quickly and easily, also they allow that information can be exposed to different threats, particularly when people don´t know their important role in the security chain. ACADEMUSOFT, the academic information system of Pamplona University, is no divorced from reality, so in this project a Risk Prevention Methodology for Academic Information Systems (MePRiSIA) was designed in order to identify risks which personal information, handled by these systems, is exposed and to propose strategies to prevent and mitigate them. This methodology consists of four steps: establishing the context, risk identification, risk analysis and risk prevention. To define MePRiSIA was first developed a state of the art and a comparison of management and risk prevention methodologies found in the literature. MePRiSIA was evaluated by 3 experts, through a rubric and the Delphi method, who determined that it is easy to understand and includes the human factor, but its implementation is difficult when the institution does not allocate sufficient resources to carry it out. In addition, MePRiSIA was applied in the academic information system of Pamplona University, where it was shown that the greatest risks are caused by the lack of policies, their dissemination and the lack of training and awareness in security of teachers, CIADTI staff and students.