Auditoría de controles de cifrado y protección de la información

The study entitled audit of encryption controls and information protection aims to evaluate the level of data security, identifying possible risks and deficiencies in its protection. For this purpose, it is based on the ISO 27002 standard, which establishes specific controls to guarantee the confidentiality, integrity and availability of information. This work has been developed based on previous research in the area of computer security auditing, with the purpose of structuring an effective methodology to detect vulnerabilities and suggest improvement strategies. Audit models used in other companies have been analyzed, contrasting their results with those obtained in this research. The study includes an exhaustive analysis of the security controls implemented, focusing especially on encryption and protection of sensitive information, identifying potential vulnerabilities in the access and storage of financial and administrative data. Through a systematic audit process, key aspects such as cryptographic key management, backup procedures and the application of control measures recommended by international standards such as ISO 27001 and NIST 800-53 are reviewed.