Segurança da informação com foco em infraestrutura: um estudo de caso em uma empresa do setor de tecnologia da informação

Abstract

This paper aims to analyze the infrastructure of the organization in the aspect of information security. Although information security has three basic principles, the focus was only on the availability of information. The principles of integrity and confidentiality would jeopardize the organization. The analysis is necessary because the information security is not obtained with a single effort. Thus, the company must always be evaluated and reviewed to identify new risks and to verify the effectiveness of the solution to combat the risks already identified. For this analysis, a survey was conducted on the topology of computer network of the company both at headquarters and in its subsidiary. Additional information such as the status of computing resources were also identified. Based on material obtained in the survey, the topology of computer networks were modeled in the simulation software OPNET IT Guru Edition. The current scenario of the topology and a proposed scenario with possible improvements were modeled, simulated and compared. The comparison of the results was based on network latency and traffic on the switches. Network latency showed an improvement of 40% over the current scenario. In turn, the traffic in the switches (bits per second) showed a decrease of up to 13.6 times compared to the current scenario. As information security is considered a management process within the company and involves all sectors of an organization, this work could not cover all aspects. However, based on four employees of the organization, two managers, a developer and responsible for the infrastructure, an assessment was made of the infrastructure in relation to physical security, logical and human resources. The evaluation was done using QBASE (Basic Assessment Questionnaire Information Security) proposed by Fontes. In this evaluation, the company achieved 47.14% efficiency in their physical security, logical security at 60% and 17.5% for safety in human resources. Considering the safety of the infrastructure as a whole, the company gets a total effectiveness in its infrastructure of 41.55%. Thus, the weaknesses and strengths of the organization's infrastructure that were found in the simulation are identified in the questionnaire and should be analyzed in order to improve its effectiveness and ensure its continuity in the market.