Procedimento de análise de riscos em cybersecurity: aplicação em uma empresa de produção de gases industriais e medicinais

Abstract

This work aimed to apply a cybersecurity risk analysis procedure in a multinational company in the field of industrial and medical gases. The company under study uses an Information Security Management (ISM) system that is standard for all its units all over the world. The risk identification step represented the scope of this study and consists of the application of a procedure composed of three parts: Business Service Level Description (BSLD), Risk Assessment and Vulnerability scanning. Each of these procedures has specific attributions and objectives and are based on questionnaires, risk analysis and verification of application or software vulnerabilities that are candidates for insertion in the company. An individual analysis of the application of one of the ISM components to a candidate system for insertion in the company was carried out. It was observed that the applied procedures have an extensive and time-consuming character, which may be a vulnerability of the cyber-risks protection strategy. In addition, unprepared managers can leave important gaps within the application of procedures, reducing the quality of analysis.