Análisis de riesgos y amenazas de ciberseguridad en el estado ecuatoriano, utilizando la metodología Magerit

Abstract

The Ecuadorian state, due to its size, economic relevance, and vast amount of confidential information, has become an attractive target for cyber attackers. This has led to the conduct of a study focused on the analysis of cybersecurity risks and threats to the country's assets. The proposed objectives were: a) To carry out an analysis of risks and threats of cybersecurity in the Ecuadorian state, to determine the vulnerabilities to which the country is exposed, b) To conduct a theoretical study on the methodologies of analysis and risk management that can be applied to countries, c) To carry out a survey of critical information assets belonging to the Ecuadorian State, d) To analyze the risks, determine vulnerabilities, and threats of cybersecurity for the critical assets of the Ecuadorian state using the Magerit methodology. The MAGERIT methodology was applied to identify and categorize threats, vulnerabilities, and risks, classifying critical assets into areas such as government, health, and energy, and threats according to their origin, such as user errors, technical failures, deliberate attacks, and natural disasters. The study evaluated the potential impact of each threat in terms of confidentiality, integrity, and availability, and estimated the likelihood of occurrence, thus calculating the risk level to prioritize mitigation actions. The results revealed that the assets with the highest risks are the personal and financial data of citizens, medical records, and confidential governmental information. Keywords: cybersecurity, Magerit methodology, critical infrastructure, Ecuador.