Implementación de un sistema de alerta temprana de autenticación para los administradores de sistemas críticos, que permita reportar accesos no autorizados de la empresa de telecomunicaciones y seguridad informática

Abstract

The objective of this thesis is to develop an early warning authentication system suitable for administrators of critical systems in a telecommunications and information security company. The goal is to report unauthorized access and improve institutional logical security. Existing tools are being used to create automatic alerts based on authentication events for anomalous access patterns and to enable early response to potential security issues. Information was gathered on critical systems, event logs, and the personnel responsible for their administration. Implementation involved configuring SIEM platforms, additional monitoring mechanisms, and connecting them to existing authentication systems. Furthermore, system validation procedures, functionality testing, and documentation were established to enable system functionality. Testing in a laboratory environment allowed for the evaluation of system performance against unauthorized access attempts, privilege changes, and after-hours access, facilitating the adjustment of thresholds and the reduction of false positives. Thus, the project offers a solution that complies with the ISO/IEC 27002 standard and is suitable for highly critical environments. Keywords: Information security, authentication, critical systems, early warnings, unauthorized access, SIEM.