Metodología práctica de auditoria informática en seguridad lógica para aplicativos contables y financieros en Pymes

Abstract

The article proposes a practical methodology of computer security audit focused on SMEs for accounting and financial applications, collecting, organizing and analyzing information based on a process of conceptual appropriation as audited, evidencing ignorance by executives and company personnel added to the lack of economic resources to have access to professionals trained in computer audit who can evaluate and verify the integrity, availability and reliability of the information in the software; confirming ESET in its security report LATAM 2018, that the theft of information in Latin American companies is 51% (ESET, 2018). The methodology is developed under the Plan-Do-Check-Act (PDCA) framework, which facilitates the process of diagnosing the company's logical security status through review and analysis. The information system S1ESA 8.5, application with 10,000 client companies in 7 Latin American countries (SIESA), is taken as a case study, for the creation of this model, a set of instruments that enable the analysis and evaluation of risks is shown, the techniques used to know and understand the current status of business organizations evaluated and that can be applied to perform security audit processes (Solarte, Rosero, & del Carmen Benavides, 2015) allowing an SME to take the respective actions and controls preventive or corrective, strengthening the logical security of the application and the company's digital ecosystem.