auditoria. agenda innovatec services chicoche systems chicoche systems services critical asset...

Auditoria

AGENDA• Innovatec• Services

• Chicoche Systems• Chicoche Systems Services

• Critical Asset Worksheet for people• Critical Asset Worksheet for Information

INNOVATEC• We are a young company formed by a trained multidisciplinary

group of people with whom your institution, company, shop, service or project can support you in the area of Information Technology.

INNOVATEC SERVICES• Software Factory: Development of software designed to solve

specific customer problems.

• Web design: We develop portals with custom design

• Technical Support: Our team of technicians offer a quick solution to the problems of our customers.

CHICOCHE SYSTEMS BACKGROUND

CHICOCHE SYSTEMS BACKGROUND• Chicoche Systems is a specialized company in the area of

telecommunications in Villahermosa Tabasco.

CHICOCHE SYSTEMS SERVICES• Specialized Support• Security Services • Network Design• Network Implementation• Voice and Unified Communications• Wireless Services• Video Services• TelePresence Services• Routing services• Switching services

VOLUME 8:CRITICAL ASSET FOR PEOPLE

Chicoche systems organizational structure

ORGANIZATIONAL STRUCTURE• The company has 5 main Departments:• CEO.• The Networks Department , which consists of four sub

departments: Network design and implementation, voice, wireless and requirements.

• The Systems area consist of two sub departments: Informatics security and systems.

• The Help Desk department.• The Administrative Area consist of five sub departments:

Sales, Human Resources, Accounting, Physic Security and Quartermaster.

PEOPLE ASSETS• They’ve got 50 employees• A total of 17 differents jobs

CRITICAL PEOPLE• CEO : Manager• Networks Department : Chief of Networks Department• Systems Area : Chief of the Systems Area• Help Desk Department : Chief of Help Desk• Administrative Area : Chief of Administrative Area

WHAT ARE THE SECURITY REQUIREMENTS FOR THESE PERSONS?• In general, the experience, knowledge and

skills that provide this group of people, it is necessary to avoid the performance and productivity of the company are affected.

ABSENCE OF PEOPLE.• Key people taking a temporary absence.• Key people leaving the organization permanently.• Threats affecting a third-party or service provider

Good Things• Chicoche systems has a good organizational structure.• Chicoche systems have well established functions of almost all

the employees.

BAD THINGS• Chicoche systems don’t has a plan for what to do if an

employee don't go to work.• Not enough information about each department functions.

RECOMMENDATIONS• Established contingency plan in case of an employee does not

attend to work.• Establish the tasks of each area.• Established functions of all the employees.

Critical asset for Information• Client information.• Finance information.• Project information.• Sensible information that your company needs for work.

NETWORK ACCESS INFORMATION• Good things• The company has a privacy policy.

• Bad points.• There are no rules of restriction of information.• There is not well established who uses the internal information.• There is no protection for the information against external

people.

Recommendations• Implement user politics to access to the information on the

website.• Get a firewall.

Human actors using physical access• Bad Things• The company doesn’t have security systems• The company doesn’t have an insurance in case of robbery. • The company doesn’t have politics about the how protect the

equipment.

Good Things• The company have security against external people.• The company have physical restrictions.

• Recommendations• The company should improve its security using security systems.

System problems/Other problems• Good things.• There is established the help desk is going to attend a problems.

• Bad things• The company don’t have plans for lost of information and for

infrastructure problems.• The company don’t have plans about natural disaster.• The company don’t have plans about a emergency power.

Recommendations

• There are no sufficient information about if a system fails.• The company should sign up an insurance service.• The company should make a natural disaster plan.• The company should consider an emergency power supply.

Other Problems• The company has a plan in case of infrastructure problems.