Propuesta de una mejora de la seguridad de la información en un negocio fiduciario dando cumplimiento a la ley de protección de datos personales en el Ecuador usando una prueba de concepto y proponiendo una contramedida

Abstract

The protection of personal information is a crucial aspect of modern information management, especially in the digital context. In Ecuador, the Organic Law on Personal Data Protection (LOPDP) establishes clear guidelines for organisations to ensure the confidentiality, integrity and availability of the information they handle. This legal framework is particularly relevant for fiduciary businesses, which deal with highly sensitive information related to their clients, making them priority targets for cyber-attacks and risks of unauthorised disclosure of data. This paper proposes an approach to strengthen information security in Ecuadorian trust businesses through an Information Security Management System (ISMS) based on ISO/IEC 27001:2022. The proposal includes essential elements such as ongoing staff training. Additionally, a proof of concept was developed to validate the effectiveness of the proposed measures. The results showed 35% had adequate knowledge of LOPDP.