O estado brasileiro e a cultura de segurança da informação: estudo de caso sobre a implantação de um projeto de segurança da informação em um órgão da administração pública federal

Abstract

This paper aims at showing to what extent the culture of Information Security is present in an organ of the Brazilian Federal Public Administration, emphasizing the difference in perception between professionals of Information Technology and professionals who work in the final activity of the organization. The data on the basis of this case study were collected through a questionnaire prepared with the intention of capturing, within the research theme, the current situation of the company as senior management positions itself as the mechanisms used impact the work of professionals consulted and how they position themselves in relation to the subject. The initial attempt to understand the data and analysis of results, by comparing the answers by reading the questionnaires, it turned out dry and difficult to implement. The data analysis was only possible after the completion of a consolidation of the main arguments raised by respondents in separate worksheets for profile professional performance. From this intermediate result could clearly see the difference in position coming from the expectations inherent in the respective fields, and consider more clearly the motivations for agreement and disagreement in the responses observed. Occupational Information Technology wishing to establish a strong culture of Information Security, because they understand that this protects the organization and people from real threats and increasingly present in contemporary society, the professionals who are customers of Technology information organization, despite understanding the need to establish a strong culture of Information Security, worries that the hype in the establishment and implementation of rules and security mechanisms can seriously damage your productivity and your quality of life. The points of agreement observed shows risks to the Brazilian government plans to establish a culture of Information Security throughout the structure of the Federal Public Administration, because they reveal a lack of commitment from top management, lack of standards and a level of awareness and encourage adoption of best safety practices in daily activities of people, as well as lack of interest of the entire management structure with the proposals presented to them in order to carry out any activity or start a process of educating the public about the risks that are subject in their daily activities and that they put their organization at risk. Considering the results obtained, it is necessary to monitor the developments in this organization, especially after the disclosure of this work in order to see how the reaction will be the decision makers.