Implementación de políticas y procedimientos para la gestión de incidentes de seguridad informática por medio de un sistema automatizado de tickets desarrollado en código abierto, para la puesta en marcha del CSIRT del Comando de Ciberdefensa.

Abstract

Abstract:The present titling work (TT) was developed for the military CSIRT of the Armed Forces Cyber Defense Command; taking as reference the best practices for the management and management of computer security incidents recommended by international organizations such as: FIRST, INCIBE and ENISA. In this sense, an information survey is carried out with the personnel working in military CSIRT, to know the policies and procedures that are currently used for incident management, in addition to verifying if the organization has a Help Desk type system, which allow to generate entries for the registration and attention of the most recurring incidents that affect military information assets. As a result, this titling work provides a policy that meets the needs of COCIBER, for the management of computer security incidents and procedures that allow to better manage the different attack vectors that affect military information systems, in addition to the implementation of an Open Source ticket management system called "RTIR", which is used by most CSIRTs worldwide and was configured according to the requirements of the Armed Forces CSIRT.