Cis critical security controls (CIS CONTROLS) para la mitigación de vulnerabilidades de seguridad en la infraestructura de red de la Unidad Educativa General Eloy Alfaro de la ciudad de Salcedo.

Abstract

The growing technological dependence in educational institutions has turned information systems into critical assets, which underscores the need to implement robust cybersecurity strategies to protect confidential data and ensure operational continuity. The purpose of this work focuses on the General Eloy Alfaro educational unit in the city of Salcedo, which faces significant cyber and physical threats due to its limited resources and the lack of defined security practices. The research began with the identification of critical assets and the analysis of the institutional network's current status. Subsequently, a network diagnosis was carried out using the Nessus vulnerability analysis tool. The results obtained were classified under the CIS Controls framework, and through a qualitative risk matrix, the educational unit's degree of exposure to threats was measured, laying the foundation for the remediation proposal. The diagnostic results revealed that the most significant risks were due to the lack of essential controls such as SMB signing. To mitigate these deficiencies, a selection of the CIS Controls was implemented, chosen and adapted according to the educational unit's infrastructure and resources. As a result, the cybersecurity maturity of the educational unit was increased, providing a replicable and sustainable model that promotes a proactive culture of risk management despite budgetary limitations.