Modelo estadístico para evaluar la efectividad de políticas de ciberseguridad empresarial
Organizations increasingly adopt frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework 2.0, yet the performance of the resulting cybersecurity policies is still assessed mainly through compliance checklists and qualitative judgment. Incident records, which most organizations already...
Guardado en:
| Autor principal: | |
|---|---|
| Otros Autores: | |
| Formato: | Tesis de pregrado |
| Lenguaje: | español |
| Publicado: |
Universidad Peruana Unión
2026
|
| Materias: | |
| Acceso en línea: | Enlace permanente (DOI o Handle) |
| Etiquetas: |
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1881545247855476736 |
|---|---|
| author | Delgado Paucar, Katherine |
| author2 | Lopez Gonzales, Javier Linkolk |
| author_browse | Delgado Paucar, Katherine Lopez Gonzales, Javier Linkolk |
| author_facet | Lopez Gonzales, Javier Linkolk Delgado Paucar, Katherine |
| author_sort | Delgado Paucar, Katherine |
| collection | Repositorio institucional |
| description | Organizations increasingly adopt frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework 2.0, yet the performance of the resulting cybersecurity policies is still assessed mainly through compliance checklists and qualitative judgment. Incident records, which most organizations already collect, are rarely exploited as quantitative evidence of policy performance. This study proposes a reproducible statistical framework, grounded in the Knowledge Discovery in Databases (KDD) process, that converts cybersecurity incident records into quantitative evidence to support policy-performance assessment. The framework integrates exploratory data analysis (EDA), principal component analysis (PCA), K-Means clustering, and dispersion-aware generalized linear modeling (GLM) of incident counts, and is implemented as an interactive R Shiny decision-support application. Its behavior was demonstrated on a public synthetic dataset of 100,000 cybersecurity incidents. The first four principal components explained 84.48% of the total variance; PC1 (28.75%) captured incident containment (resilience, attack duration, and response time) and PC2 (27.14%) incident volume and economic impact. K-Means yielded three exploratory technical profiles, although the mean silhouette coefficient (0.185) indicated weak cluster separation. The Poisson reference model was markedly underdispersed (Pearson dispersion ratio = 0.353); therefore, inference was based on a quasi-Poisson model with a log link. Log-transformed economic impact was positively associated with expected incident frequency (β=0.747; IRR ≈2.11; p<0.001), whereas mean severity was negatively associated with it (β=-0.139; IRR ≈0.870; p<0.001). Cross-site scripting differed statistically from the reference attack category, but with a negligible effect size (IRR = 0.981; p=0.011). Because the synthetic incidents are close to uniformly distributed, the built-in diagnostics correctly signaled weak structure instead of producing spurious risk categories, illustrating the value of explicit interpretive safeguards. The main contribution is methodological: an end-to-end, transparent, and reproducible workflow that organizations can apply to their own incident logs to monitor policy performance over time. Validation with real organizational incident records is the necessary next step. |
| escuela_str_mv | Escuela de Posgrado |
| format | info:eu-repo/semantics/bachelorThesis |
| id | oai:repositorio.upeu.edu.pe:20.500.12840/10766 |
| institution | UPeU |
| language | Spanish |
| linea_str_mv | Modelos estadísticos |
| ocde_area_str_mv | Ciencias naturales |
| ocde_disciplina_str_mv | Matemáticas |
| ocde_str_mv | 1.01.03 |
| programa_nombre_str_mv | SEGUNDA ESPECIALIDAD EN ESTADÍSTICA APLICADA PARA INVESTIGACIÓN |
| programa_uri_str_mv | http://upeu.edu.pe/sys/programas/programa/seg-estadistica-aplicada-para-investigacion |
| publishDate | 2026 |
| publishDateRange | 2026 |
| publishDateSort | 2026 |
| publisher | Universidad Peruana Unión |
| publisherStr | Universidad Peruana Unión |
| record_format | dspace |
| sede_str_mv | Lima |
| spelling | Modelo estadístico para evaluar la efectividad de políticas de ciberseguridad empresarial Delgado Paucar, Katherine Lopez Gonzales, Javier Linkolk Cybersecurity policy assessment Knowledge discovery in databases Incident analytics Organizations increasingly adopt frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework 2.0, yet the performance of the resulting cybersecurity policies is still assessed mainly through compliance checklists and qualitative judgment. Incident records, which most organizations already collect, are rarely exploited as quantitative evidence of policy performance. This study proposes a reproducible statistical framework, grounded in the Knowledge Discovery in Databases (KDD) process, that converts cybersecurity incident records into quantitative evidence to support policy-performance assessment. The framework integrates exploratory data analysis (EDA), principal component analysis (PCA), K-Means clustering, and dispersion-aware generalized linear modeling (GLM) of incident counts, and is implemented as an interactive R Shiny decision-support application. Its behavior was demonstrated on a public synthetic dataset of 100,000 cybersecurity incidents. The first four principal components explained 84.48% of the total variance; PC1 (28.75%) captured incident containment (resilience, attack duration, and response time) and PC2 (27.14%) incident volume and economic impact. K-Means yielded three exploratory technical profiles, although the mean silhouette coefficient (0.185) indicated weak cluster separation. The Poisson reference model was markedly underdispersed (Pearson dispersion ratio = 0.353); therefore, inference was based on a quasi-Poisson model with a log link. Log-transformed economic impact was positively associated with expected incident frequency (β=0.747; IRR ≈2.11; p<0.001), whereas mean severity was negatively associated with it (β=-0.139; IRR ≈0.870; p<0.001). Cross-site scripting differed statistically from the reference attack category, but with a negligible effect size (IRR = 0.981; p=0.011). Because the synthetic incidents are close to uniformly distributed, the built-in diagnostics correctly signaled weak structure instead of producing spurious risk categories, illustrating the value of explicit interpretive safeguards. The main contribution is methodological: an end-to-end, transparent, and reproducible workflow that organizations can apply to their own incident logs to monitor policy performance over time. Validation with real organizational incident records is the necessary next step. 2026-09-28 2026-10-05T16:04:53Z 2028-09-28 info:eu-repo/date/embargoEnd/2028-09-28 info:eu-repo/semantics/bachelorThesis https://hdl.handle.net/20.500.12840/10766 spa info:eu-repo/semantics/embargoedAccess https://creativecommons.org/licenses/by-nc/4.0/ application/pdf Universidad Peruana Unión PE oai:repositorio.upeu.edu.pe:20.500.12840/10766 2026-11-10T22:57:48Z |
| spellingShingle | Cybersecurity policy assessment Knowledge discovery in databases Incident analytics Delgado Paucar, Katherine Modelo estadístico para evaluar la efectividad de políticas de ciberseguridad empresarial |
| title | Modelo estadístico para evaluar la efectividad de políticas de ciberseguridad empresarial |
| title_full | Modelo estadístico para evaluar la efectividad de políticas de ciberseguridad empresarial |
| title_fullStr | Modelo estadístico para evaluar la efectividad de políticas de ciberseguridad empresarial |
| title_full_unstemmed | Modelo estadístico para evaluar la efectividad de políticas de ciberseguridad empresarial |
| title_short | Modelo estadístico para evaluar la efectividad de políticas de ciberseguridad empresarial |
| title_sort | modelo estadistico para evaluar la efectividad de politicas de ciberseguridad empresarial |
| topic | Cybersecurity policy assessment Knowledge discovery in databases Incident analytics |
| topic_facet | Cybersecurity policy assessment Knowledge discovery in databases Incident analytics |
| url | https://hdl.handle.net/20.500.12840/10766 |
| work_keys_str_mv | AT delgadopaucarkatherine modeloestadisticoparaevaluarlaefectividaddepoliticasdeciberseguridadempresarial |