Um framework para o gerenciamento de riscos em segurança da informação no Poder Judiciário do Tocantins

Abstract

In the current scenario, in which the Judiciary of the State of Tocantins is increasingly dependent on information and its computer systems, it is essential to identify the threats that may harm the achievement of institutional objectives, as well as to assess the impact, relevance and consequences that the non-conformity of the technological infrastructure with the security norms can cause in the main activity of the Tocantinense Judiciary. This work aimed to develop a framework for risk management in information security, aiming to improve the governance of information and communication technology in the Judiciary of Tocantins. To achieve the objectives of this research, the main standards of the Brazilian Association of Technical Standards were analyzed, focused on information security and risk management. As tools that make up the framework, artifacts were created that allowed to identify, analyze, evaluate and treat risk events. In order to validate the framework, a practical application was made through a case study focusing on the area of administration and network security of the Court of Justice. As for the risk management method developed, it can be said that it proved to be efficient, since it was possible to map the main risk events, with their causes and consequences, and thus elaborate a set of mitigation measures.