Gestão integrada de riscos em ambientes universitários: cibersegurança, informação e privacidade de dados
DOI:
https://doi.org/10.34117/bjdv11n7-071Keywords:
gestão de risco, segurança da informação, universidadesAbstract
Este estudo propõe um modelo de gestão de riscos que integra requisitos de privacidade de dados, adaptado ao contexto universitário. Diante do crescimento das interações digitais e dos desafios na proteção de informações sensíveis em ambientes acadêmicos, a pesquisa analisa regulamentações como o GDPR e frameworks reconhecidos, como o NIST SP 800-30 e a ISO/IEC 27005. Por meio da identificação de ativos e da avaliação de riscos em um laboratório de IoT de uma universidade, o estudo demonstra os desafios enfrentados pela instituição, como descentralização de dados ou falta de cultura em segurança da informação. O modelo busca integrar, de forma prática, a gestão de riscos com a privacidade de dados, oferecendo uma solução pragmática para mitigar ameaças e vulnerabilidades específicas do ambiente acadêmico. Os resultados indicam que a aplicação desse modelo pode fortalecer a proteção de dados sensíveis e contribuir para uma postura mais segura. Entre as limitações, destaca-se o foco em uma única instituição e área, sugerindo que pesquisas futuras explorem sua aplicabilidade em outros contextos universitários. A abordagem proposta visa equilibrar conformidade regulatória e eficiência operacional, servindo como um guia para instituições educacionais que buscam alinhar privacidade e segurança em suas infraestruturas digitais.
References
ALGER, J. 500,000 people impacted by ransomware attack on Columbus, Ohio. Security Magazine, 21 dez. 2024. Disponível em: https://www.securitymagazine.com /articles/101177-500-000-people-impacted-by-ransomware-attack-on-columbus-ohio.
AMUYA, L. O.; KARIUKI, P. M. Organisational characteristics as antecedents of enterprise security risk management adoption in Kenya’s accredited universities. Journal of Higher Education Policy and Management, v. 46, n. 1, p. 1–17, 2024. https://doi.org/10.1080/1360080X.2023.2235772
ARISTA, A.; NGAFIDIN, K. N. M. An information system risk management of a higher education computing environment. International Journal on Advanced Science, Engineering and Information Technology, v. 12, n. 2, p. 557–564, 2022. https://doi.org/10.18517/ijaseit.12.2.13953.
BONGIOVANNI, I. The least secure places in the universe? A systematic literature review on information security management in higher education. Computers & Security, v. 86, p. 350–357, 2019. https://doi.org/10.1016/j.cose.2019.07.003
DIOUBATE, B. M.; DAUD, W.; NORHAYATE, W. Cybersecurity risk management frameworks implementation in Malaysian higher education institutions. International Journal of Academic Research in Business and Social Sciences, v. 12, n. 4, p. 1356–1371, 2022. https://doi.org/10.6007/IJARBSS/v12-i4/12300.
EUROPEAN PARLIAMENT AND COUNCIL. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L119, p. 1–88, 2016. https://eur-lex.europa.eu/eli/reg/2016/679/oj.
FERRAMENTAS DA QUALIDADE. Matriz de Riscos – Matriz de Probabilidade e Impacto. Disponível em: https://ferramentasdaqualidade.org/matriz-de-riscos-matriz-de-probabilidade-e-impacto/. Acesso em: 01 jul. 2025.
GANESAN, R. et al. Cybersecurity risk assessment: modeling factors associated with higher education institutions. International Journal of Advanced Computer Science and Applications (IJACSA), v. 13, n. 8, 2022. https://doi.org/10.14569/IJACSA.2022.0130843.
GANIN, A. A. et al. Multicriteria decision framework for cybersecurity risk assessment and management. Risk Analysis, v. 40, n. 1, p. 183–199, 2020. https://doi.org/10.1111/risa.12891.
GHAZVINI, A.; SHUKUR, Z.; HOOD, Z. Review of information security policy based on content coverage and online presentation in higher education. International Journal of Advanced Computer Science and Applications (IJACSA), v. 9, n. 8, 2018. https://doi.org/10.14569/IJACSA.2018.090853.
HERNANDEZ, L.; PRANOLO, A.; WIBAWA, A. P. Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis: Case study: Higher education institution. Transactions on Energy Systems and Engineering Applications, v. 5, n. 2, p. 635, 2024. https://doi.org/10.32397/tesea.vol5.n2.635.
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. ISO 31000:2018 – Risk management – Guidelines. 2018. Disponível em: https://www.iso.org/obp/ui/en/#iso:std:iso:31000:ed-2:v1:en.
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. ISO/IEC 27001:2013 – Information technology – Security techniques – Information security management systems – Requirements. 2013. Disponível em: https://www.iso.org/standard/54534.html.
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. ISO/IEC 27002:2022 – Information security, cybersecurity and privacy protection — Information security controls. 2022. Disponível em: https://www.iso.org/obp/ui/en/#iso:std:iso-iec:27002:ed-3:v2:en.
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. ISO/IEC 27005:2018 – Information technology – Security techniques – Information security risk management. 2018. https://www.iso.org/standard/80585.html
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. ISO/IEC 27005:2022 – Information technology – Security techniques – Information security risk management. 2022. https://www.iso.org/standard/80585.html
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. ISO/IEC 27701:2019 – Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines. 2019. Disponível em: https://www.iso.org/obp/ui/en/#iso:std:iso-iec:27701:ed-1:v1:en.
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. ISO/IEC 29100:2024 – Information technology — Security techniques — Privacy framework. 2024. Disponível em: https://www.iso.org/cms/render/live/en/sites/isoorg/contents/da ta/standard/08/59/85938.html.
IRSHEIDA, A.; MURAD, A.; ALNAJDAWI, M.; QUSEF, A. Information security risk management models for cloud-hosted systems: A comparative study. Procedia Computer Science, v. 207, p. 1726–1735, 2022. https://doi.org/10.1016/j.procs.2022.08.025
ISACA. COBIT 5: A business framework for the governance and management of enterprise IT [White paper and toolkit]. 2012. https://store.isaca.org/s/store#/store/browse/detail/a2S4w000004KoCDEA0.
JOUINI, M.; RABAI, L. B. A.; KHEDRI, R. A multidimensional approach towards a quantitative assessment of security threats. Procedia Computer Science, v. 52, p. 507–514, 2015. https://doi.org/10.1016/j.procs.2015.05.024.
JUFRI, M. T.; HENDAYUN, M.; SUHARTO, T. Risk-assessment based academic information system security policy using OCTAVE Allegro and ISO 27002. Proceedings of the 2nd International Conference on Informatics and Computing (ICIC 2017), 2018-Jan., p. 1–6. https://doi.org/10.1109/IAC.2017.8280541.
LAMARCA, B. I. Cybersecurity risk assessment of the University of Northern Philippines using PRISM approach. IOP Conference Series: Materials Science and Engineering, v. 769, 012066, 2020. https://doi.org/10.1088/1757-899X/769/1/012066.
Leithardt, V., G. Borges, A. Rossetto, C. Rolim, Claudio Geyer, L. Correia, David Nunes, and J. Sá Silva. "A privacy taxonomy for the management of ubiquitous environments." J. Commun. Comput 10, no. 10.17265 (2013): 1548-7709. Disponível em: https://www.davidpublisher.com/Public/uploads/Contribute/5539ed57ad7f0.pdf
Leithardt¹, Valderi RQ, David Nunes, Anubis GM Rossetto¹, Carlos O. Rolim¹, Cláudio FR Geyer¹, and Jorge Sá Silva. "Privacy Management Solution in Ubiquitous Environments Using Percontrol." Journal of Ubiquitous Systems & Pervasive Networks 5, no. 2 (2014): 21-28. Disponível em: https://iasks.org/articles/juspn-v05-i2-pp-21-28.pdf
LI, J.; XIAO, W.; ZHANG, C. Data security crisis in universities: Identification of key factors affecting data breach incidents. Humanities and Social Sciences Communications, v. 10, n. 1, p. 270, 2023. https://doi.org/10.1057/s41599-023-01757-0.
OH, J.; LEE, K. Data de-identification framework. Computers, Materials & Continua, v. 74, n. 2, p. 3579–3595, 2023. Disponível em: https://doi.org/10.32604/cmc.2023.031491.
KAIL, E.; RIETHNÉ NAGY, A.; FLEINER, R. et al. Low-impact, near real-time risk assessment for legacy IT infrastructures. International Journal of Information Security, v. 24, p. 67, 2025. https://doi.org/10.1007/s10207-024-00971-4.
KHADKA, K.; ULLAH, A. B. Human factors in cybersecurity: an interdisciplinary review and framework proposal. International Journal of Information Security, v. 24, p. 119, 2025. https://doi.org/10.1007/s10207-025-01032-0.
KHAW, T. Y.; TEOH, A. P. Risk management in higher education research: A systematic literature review. Quality Assurance in Education, v. 31, n. 2, p. 296–312, 2023. https://doi.org/10.1108/QAE-04-2022-0097.
KITCHENHAM, B.; CHARTERS, S. Guidelines for performing systematic literature reviews in software engineering (EBSE 2007-001). Keele University and Durham University Joint Report, 2007. Disponível em: https://www.researchgate.net/publicati on/302924724_Guidelines_for_performing_Systematic_Literature_Reviews_in_Software_Engineering
KITSIOS, F.; CHATZIDIMITRIOU, E.; KAMARIOTOU, M. The ISO/IEC 27001 information security management standard: How to extract value from data in the IT sector. Sustainability, v. 15, n. 7, p. 5828, 2023. https://doi.org/10.3390/su15075828.
KRAMARZ, K.; KORPYSA, J. The evolution of the concept of risk management in IT+ organizations. Procedia Computer Science, v. 225, p. 4843–4849, 2023. https://doi.org/10.1016/j.procs.2023.10.484.
RANDIKA, S. S.; WIJAYANAYAKE, J. Information security governance, risks and vulnerabilities in cloud adoption: A systematic literature review of Sri Lankan organizations. In: 2025 International Research Conference on Smart Computing and Systems Engineering (SCSE). Anais [...]. p. 1–6. 2025. https://doi.org/10.1109/SCSE65633.2025.11031004.
SALAM, M.; BAKAR, K. A. A.; AMAN, A. H. M. Building cyber-resilient universities: A tailored maturity model for strengthening cybersecurity in higher education. International Journal of Advanced Computer Science and Applications, v. 16, n. 5, p. 95–104, 2025. https://doi.org/10.14569/IJACSA.2025.0160510.
SETYADI, A.; PAWIROSUMARTO, S.; DAMARIS, A. et al. Risk management, digital technology literacy, and modern learning environments in enhancing learning innovation performance: A framework for higher education. Education and Information Technologies, 2025. https://doi.org/10.1007/s10639-025-13380-4.
SRIVASTAVA, M. K.; PATEL, U. Cyber security risk analysis of IoT ecosystem. In: 2025 International Conference on Sustainable Energy Technologies and Computational Intelligence (SETCOM). Anais [...]. p. 1–6. 2025. https://doi.org/10.1109/SETCOM64758.2025.10932432.
STONEBURNER, G.; GOGUEN, A.; FERINGA, A. Risk management guide for information technology systems (NIST Special Publication 800-30). Gaithersburg, MD: National Institute of Standards and Technology, 2002. https://doi.org/10.6028/NIST.SP.800-30.
ULVEN, J. B.; WANGEN, G. A systematic review of cybersecurity risks in higher education. Future Internet, v. 13, n. 2, p. 39, 2021. https://doi.org/10.3390/fi13020039.
VERIZON. 2024 Data breach investigations report. 2024. Disponível em: https://www.verizon.com/business/resources/reports/dbir/. Acesso em: jul. 2025.
VIECCO, L. R.; AREVALO, J. G. Information technology governance model, based on risk management and information security for Colombian public universities: Case study University of La Guajira. IOP Conference Series: Materials Science and Engineering, v. 844, n. 1, p. 012045, 2020. https://doi.org/10.1088/1757-899X/844/1/012045.
WAQDAN, M.; LOUAFI, H.; MOUHOUB, M. Security risk assessment in IoT environments: A taxonomy and survey. Computers & Security, v. 154, p. 104456, 2025. https://doi.org/10.1016/j.cose.2025.104456.
WEBB, J.; AHMAD, A.; MAYNARD, S. B.; SHANKS, G. A situation awareness model for information security risk management. Computers & Security, v. 44, p. 1–15, 2014. https://doi.org/10.1016/j.cose.2014.04.005.
