Proyectos de titulación Ingeniería en Sistemas de Información
URI permanente para esta colecciónhttps://dspace.ucacue.edu.ec/handle/ucacue/23430
Examinar
Envíos recientes
Item type: Publicación , Access status: Acceso Abierto , Diseño de un sistema de gestión de protección de datos personales para la Cooperativa de Ahorro y Crédito Achik Inti Ltda.(Universidad Católica de Cuenca, 2026) Sanchez Paucar, Hendry AlfredoAchik Inti Ltda. Savings and Credit Cooperative processes personal and credit data of its members without having a formal system in place to guarantee compliance with Ecuador’s Organic Law on Personal Data Protection (LOPDP, by its acronym in Spanish). This research aimed to design a personal data protection management system for the organization, aligning the requirements of the LOPDP with the ISO/IEC 27001, ISO/IEC 27002, and ISO/IEC 27701 standards, as well as the MAGERIT version 3 risk analysis methodology. The study, of an applied and projective type with a non-experimental, cross-sectional design and a mixed approach, developed a diagnostic assessment using a structured survey consisting of fifty-five items organized into ten control domains, administered to all heads of the four technical areas (n = 4), as well as an inventory and evaluation of twenty-four information assets. The results revealed an overall compliance rate of 62.7%, with critical gaps in incident management (16.7%) and the compliance domain (25%), as well as thirteen assets with very high criticality. Based on this evidence, the proposal was designed: a manual of policies and procedures, a matrix of roles headed by the Data Protection Officer, a risk matrix with its treatment plan, and the record of processing activities, all structured according to the plan, do, check, act (PDCA) cycle. The proposed system offers the cooperative a verifiable path toward the proactive and demonstrated accountability required by Ecuadorian regulations. Keywords: personal data protection; LOPDP; management system; risk analysis; savings and credit cooperativeItem type: Publicación , Access status: Acceso Abierto , Plan de Continuidad de negocio para los servicios digitales de COAC Yuyay Ltda basado en la norma ISO 22301:2019(Universidad Católica de Cuenca, 2026) Defas Ludizaca, Steve GeovannyThe growing reliance on digital technology in financial institutions has increased the need for tools to manage and restore operations during technology failures, cyberattacks, human error, power outages, and other disruptive events. The purpose of this research is to develop a business continuity plan for the digital services of Cooperativa de Ahorro y Crédito “Yuyay” Ltda. using the framework provided by the ISO 22301:2019 standard. The research is conducted using a mixed-methods approach, descriptive and applied, which employs qualitative analyses of internal processes and business continuity capabilities, as well as a quantitative assessment of vulnerabilities. The investigation involves gathering institutional information, identifying the processes and technologies in use, conducting a business impact analysis, analyzing risks, and defining recovery parameters such as Maximum Tolerable Period of Disruption (MTPD), Recovery Time Objective (RTO), and Recovery Point Objective (RPO). Based on the information obtained during the investigation, recovery priorities will be selected, and business continuity measures will be developed. The research focuses on developing a business continuity plan that includes guidelines for contingency planning, recovery, and continuous improvement during implementation. The research will not include the full implementation of the strategies provided or the organization’s certification under the ISO 22301:2019 standard. Keywords: business continuity, ISO 22301, digital services, business impact analysis, risk managementItem type: Publicación , Access status: Acceso Abierto , Plan de continuidad de negocios basada en la norma ISO 22301 para los servicios digitales del GADIC Suscal(Universidad Católica de Cuenca, 2026) Siguencia Urgiles, Juan DiegoABSTRACT The Decentralized, Intercultural, and Participatory Autonomous Government of the Suscal Canton (GADIPCS) provides digital services for tax collection, cadastras management, property registration, its website, and internal systems that rely on a technological infrastructure lacking formal procedures for recovery in the event of disruptions. The study aimed to design a Business Continuity Plan based on the ISO 22301:2019 standard for these services. A qualitative approach was adopted, using a single-case study design with a descriptive level and diagnostic orientation, applying a checklist of 66 controls from ISO/IEC 27002:2022, documentary review, and an inventory and risk analysis of technological assets using the MAGERIT version 3 methodology. The assessment revealed an overall compliance rate of 60.6 %, with technical capabilities in place but 20% compliance with the continuity of institutional activities and zero compliance with incident management. Of the 36 assets inventoried, 15 were identified as critical; unauthorized access to the perimeter firewall reached a critical level, and reliance on a single connectivity provider reached a high level. The proposal (PCN-GADIPCS-001) defines safeguards that reduce the average risk from 14.3 to 6.4, service-specific recovery parameters, with tax collection as the top priority (8-hour RTO, 4-hour RPO), continuity strategies, a team with designated roles and alternates, severity levels and activation criteria, a five-phase response procedure, an annual testing program, and operational forms, all traceability to clauses 4 through 10 of the standard. Keywords: business continuity, ISO 22301, digital services, decentralized autonomous government, risk analysisItem type: Publicación , Access status: Acceso Abierto , Modelo de inteligencia de negocios para el análisis de facturación, morosidad y pagos en línea del servicio de recolección de residuos sólidos en la EMMAIPC-EP(Universidad Católica de Cuenca, 2026) Urgiles Campoverde, John SebastiánThis study developed a business intelligence model for analyzing billing, delinquency, and online payments for the EMMAIPC-EP solid waste collection service. The study adopted a mixed-methods approach using -a case study methodology and applying Ralph Kimball’s six-phase methodology: planning, requirements analysis, dimensional modeling, physical design, extraction, transformation, and loading, and business intelligence application development. The data was obtained from the Flectra institutional system and included the cadaster, user registry, billings, and payments for the period from November 2025 to July 2026. The model was implemented in Power BI Desktop using a fact constellation with three fact tables: billing, collections, and portfolio, and four shared dimensions: time, user, territory, and channel. The indicators were calculated using DAX metrics and presented in four dashboards. During the period, a total of 336,488 documents were issued for a total of 1,452,969.28 U.S dollars, and a total of 724,745.24 U.S dollars was collected, corresponding to a collection rate of 49.9%. The delinquency rate was 33.6% , with a total of 15,893 delinquent customers, and the parishes of Cañar and Biblián accounted for 47.5%of the delinquent portfolio. The share of online payments rose from 12.9% to 20.3% of monthly collections. The model integrates all the information needed to monitor the service’s financial management into a single tool. Keywords: business intelligence, Kimball methodology, Power BI, delinquent accounts, collectionsItem type: Publicación , Access status: Acceso Abierto , Diseño de un plan digital de negocios para la comercialización de productos andinos de la Asociación Mushuk Yuyay mediante estrategias de marketing digital y e-commerce(Universidad Católica de Cuenca, 2026) Pomavilla Chogllo, Segundo JacintoThe Mushuk Yuyay Association, an agro-production organization in Cañar canton, commercializes nine Andean products with health certifications and its own brand, but its digital presence is limited to an informational website and social media accounts that do not support online transactions. This study aimed to design a digital business plan based on information technology that integrates digital marketing, e-commerce, and data analytics to optimize the commercialization of its products. A mixed-methods approach was adopted, combining descriptive analysis with a non-experimental design in the form of a single-case study; data were collected using an institutional, production, and commercial survey form administered to the association’s administrator and supplemented by a literature review. The assessment conducted using the eMICA model classified the organization as Level 1 (presence), with early signs of interaction and no processing capabilities. Based on a comparative analysis of methodologies and tools, the following were selected: WordPress with WooCommerce, WhatsApp Business, Meta Business Suite, and Google Analytics with Looker Studio. The resulting plan includes the Business Model Canvas, a strategic digital marketing plan structured according to the SOSTAC framework, the technology architecture, a reference budget of $1,892, six key performance indicators with six-month targets, and a risk matrix, along with an implementation manual. It is concluded that the plan is a viable path for the association to evolve from the presence stage to the processing stage. Its empirical verification will occur during a subsequent implementation phase. Keywords: digital business plan, e-commerce, digital marketing, Andean products, digital maturityItem type: Publicación , Access status: Acceso Abierto , Diseño de un Sistema de gestión de seguridad de la información basado en la norma ISO 27001 para la empresa EMMAIPC-EP(Universidad Católica de Cuenca, 2026) Cantos Espinoza, Kevin AlexanderThe Cañar Canton Municipal Public Enterprise for Comprehensive Sanitation (EMMAIPC-EP) manages administrative, operational, and financial information without a formal security framework to protect the confidentiality, integrity, and availability of its assets. This research aimed to design an Information Security Management System (ISMS) for the institution based on the ISO/IEC 27001:2022 standard. A mixed approach was applied, with a descriptive level and a proposal-oriented scope, along with the ISO/IEC 27005:2022 risk management methodology. The assessment identified 91 technological assets, of which 59.3% had exceeded their useful life, with a maturity level of 1.5 out of 5, and 16 risks, five of them at a very high level and eight at a high level; the most serious finding relates to the cloud-based billing and collection system hosted under the provider’s administrative account. The proposal includes a valued inventory of 21 information assets, a risk treatment plan, a Statement of Applicability with 86 applicable controls from Annex A, a general policy, eight specific policies, seven roles, ten indicators, and twelve-month implementation model based on the PDCA cycle. The validation revealed 100% risk-control coverage and showed that 14 of the 16 risks reached an acceptable residual risk level. It was concluded that the main gaps are organizational rather than technological and that the standard is applicable to a small public enterprise when the design is adapted to its actual structure. Keywords: information security, ISMS, ISO/IEC 27001:2022, risk management, public sector.Item type: Publicación , Access status: Acceso Abierto , Diseño de un manual de políticas de seguridad de la información para el departamento de TI del GADICC, basado en la norma ISO/IEC 27001:2022(Universidad Católica de Cuenca, 2026) Vega Arcentales, Emmanuel DavidItem type: Publicación , Access status: Acceso Abierto , Análisis de agentes automatizados de trading aplicados al mercado del oro mediante backtesting en tradingview(Universidad Católica de Cuenca, 2026) Delgado Cazho, Jeaneth CarolinaThis paper analyzes the performance of five automated trading agents applied to the gold market (XAU/USD) through backtesting on TradingView, from a systems engineering perspective. The agents, representing trend-following, mean-reversion, volatility breakout, momentum, and sideways-range strategies, were implemented in Pine Script (v6) with predefined parameters and a common risk management layer based on the ATR, and were run under uniform conditions (capital of USD 10,000, commission of 0.02%, slippage of 5 ticks) over a period of approximately five and a half months using a 15-minute timeframe. No agent was profitable during the period (profit factors ranging from 0.634 to 0.926), with the MACD agent being the best relative performer, though its advantage was largely offset by transaction costs. However, all five agents executed without errors throughout the entire window, maintained drawdowns between 2.35% and 3.26%, and produced traceable metrics, demonstrating execution consistent with the programmed rules. The main limitation is the length of the simulation window, which is confined to a single market regime (a high-volatility bearish correction following gold’s all-time high in January 2026), thereby limiting the generalizability of the results. The main contribution is a documented and replicable procedure for evaluating trading agents as software artifacts in simulated environments. Keywords: automated trading agents, algorithmic trading, back testing, XAU/USD, software quality.Item type: Publicación , Access status: Acceso Abierto , Modelo Integral de transformación digital basado en marcos de gestión de TI para empresas proveedoras de servicios de internet(Universidad Católica de Cuenca, 2026) Andrade Sozoranga, Lauro VicenteInternet service providers offer a technological product, but their internal management often lacks formalization: they implement tools in isolation, without an IT governance structure, without documented processes, or indicators to verify results. In light of this problem, the research aimed to design a comprehensive digital transformation model based on IT management and governance frameworks, applicable to small-scale providers. A mixed descriptive and propositional approach was adopted through an instrumental case study at INDYTELECOM, an internet service provider in the canton of Cañar. The data were collected using four techniques: an interview with management, a 32-item digital maturity questionnaire administered as a census to the seven employees, structured observation, and a documentary analysis of the technology inventory. The results placed the company at a basic level of digital maturity, with an overall average of 2.39 out of 5; information security scored 1.46—the only score at the initial level—while operational processes achieved the highest score. A perception gap of 1.02 points was also identified between management and technical staff, present across all eight dimensions evaluated, along with a 52.6% discrepancy between manual inventory records and system reports. This paper presents the MTD-ISP model as a contribution, structured around eight dimensions, seven phases, and fourteen indicators with baseline values, along with a feasible 18-month roadmap for organizations that do not have an information technology department. Keywords: digital transformation, IT governance, digital maturity, Internet service providers, COBIT 2019.Item type: Publicación , Access status: Acceso Abierto , Planificación estratégica de tecnologías de información para la gestión de TI en la empresa EMMAIPC-EP(Universidad Católica de Cuenca., 2026) Quindi Alulema, Alex GeovannyInformation technology management in Ecuador’s municipal public enterprises often occurs without tools to guide decision-making and align it with institutional objectives. This condition characterized the Joint Municipal Public Enterprise for Comprehensive Sanitation of the Cantons of Cañar, Biblián, El Tambo, and Suscal (EMMAIPC-EP, by its Spanish acronym). This study aimed to design a Strategic Information Technology Plan that would strengthen the company's IT management and align its technological resources with its institutional planning. The research used a mixed-methods approach with a descriptive, proposal-oriented design. After comparing Ward and Peppard, ISO/IEC 38500:2024, ITIL 4, and TOGAF based on fifteen indicators derived from the literature, the Ward and Peppard methodology was selected; its six phases structured the analysis of the internal and external business environments and of information systems and technologies. The assessment, based on a review of documentation, interviews, and technical observations, revealed a capacity rating of 1.5 out of 5 across ten domains, a mission-critical system hosted on infrastructure managed by an external provider, the absence of tested backups, and technology coverage that was out of sync with the value chain. Based on that baseline, six strategic IT objectives were formulated, along with a portfolio of twelve projects prioritized by gap severity, a multi-year timeline for 2027–2030, a reference investment estimate, and a scorecard with verifiable indicators. It was concluded that strengthening technology management depends less on investment than on governance and organizational decisions. Keywords: IT planning, IT governance, Ward and Peppard methodology, municipal public enterprise, IT management.Item type: Publicación , Access status: Acceso Abierto , Desarrollo de un sistema web para la gestión de talento humano en la COAC Gañansol utilizando técnicas de Vibe coding(Universidad Católica de Cuenca., 2026) Paucar Paucar, Jonnathan GustavoThis thesis addresses the lack of an integrated information system for human resources management at the Gañansol Savings and Credit Cooperative, where personnel information was managed using office software, physical records, and manual exports from the biometric system—resulting in data dispersion, errors, and delays in retrieving information. This study aimed to develop a web-based system for human resources management using Vibe Coding techniques and web development tools, with the aim of automating and optimizing personnel administrative processes. The research adopted a mixed-methods approach with a qualitative focus and a descriptive scope; information was obtained through working meetings with Human Resources and Information Technology staff and through a documentary analysis of institutional forms. The development was organized using the Scrum framework into six four-week sprints, utilizing Python, Django, MySQL, and generative AI tools such as ChatGPT, Gemini, and GitHub Copilot, with mandatory human review of the generated code. As a result, 23 functional requirements, 21 user stories, and 24 use cases were defined, and 21 functional test cases were executed, all with a “Pass” result. It is concluded that the system centralizes the processes of recruitment, onboarding, human resources, vacation, attendance, performance, and payroll on a single platform; integrates authentication with Active Directory; and constitutes a functional version ready for institutional adaptation and implementation. Keywords: human talent management, web system, Django, Scrum, Vibe Coding, Active DirectoryItem type: Publicación , Access status: Acceso Abierto , Evaluación de la seguridad informática mediante pentesting en los sistemas de información de la Cooperativa de Ahorro y Crédito Yuyay Ltda.(Universidad Católica de Cuenca., 2026) Avalos Gomescoello, Carlos IsraelThe increasing sophistication of cyber threats exposes credit unions that safeguard members’ financial information and personal data. This study aimed to evaluate the information security of the systems at Cooperativa de Ahorro y Crédito Yuyay Ltda. using penetration testing (pentesting) techniques to identify vulnerabilities, assess risks, and propose improvement measures. The study used a mixed-methods approach, combining descriptive and applied scopes with a non-experimental, cross-sectional, field-based case study design. The technical assessment followed NIST SP 800-115, OWASP, and PTES; the risk assessment followed ISO/IEC 27005:2022 and MAGERIT; and severity was classified using Common Vulnerability Scoring System (CVSS) v4.0. The tests were conducted in a gray-box configuration on a replica server of the production environment and covered the institutional web server, the attendance-tracking application, and network services. Seven findings supported by evidence were documented: two of high severity, related to the exposure of the MySQL service on all network interfaces and the use of unencrypted HTTP; four of medium severity; and one of low severity, associated with configuration weaknesses and an unnecessarily broad attack surface. For each finding, a treatment plan was developed in accordance with ISO/IEC 27002:2022, the NIST Cybersecurity Framework 2.0, and SEPS regulations, with defined responsible parties and deadlines. It concludes that the integrated framework enables the cooperative to prioritize mitigation and conduct periodic security assessments. Keywords: pentesting, cybersecurity, vulnerabilities, CVSS, cooperatives
