Roadmap de Seguridad

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316

import pandas as pd
from datetime import datetime, timedelta
import matplotlib.pyplot as plt

class SecurityRoadmap:
    def __init__(self):
        self.roadmap_data = {
            'vision': '',
            'objectives': [],
            'current_state': {},
            'initiatives': [],
            'timeline': {},
            'resources': {},
            'risks': [],
            'success_metrics': {}
        }
        
        self.maturity_levels = {
            'ad_hoc': {'score': 1, 'description': 'Ad-hoc, sin procesos definidos'},
            'repeatable': {'score': 2, 'description': 'Procesos repetibles pero no estandarizados'},
            'defined': {'score': 3, 'description': 'Procesos definidos y documentados'},
            'managed': {'score': 4, 'description': 'Procesos gestionados y medidos'},
            'optimizing': {'score': 5, 'description': 'Optimización continua de procesos'}
        }
    
    def define_vision(self, vision_statement, time_horizon):
        """Definir visión de seguridad"""
        self.roadmap_data['vision'] = {
            'statement': vision_statement,
            'time_horizon': time_horizon,
            'created_date': datetime.now(),
            'last_updated': datetime.now()
        }
    
    def add_objective(self, objective_id, objective_data):
        """Añadir objetivo estratégico"""
        objective = {
            'objective_id': objective_id,
            'title': objective_data['title'],
            'description': objective_data['description'],
            'category': objective_data.get('category', 'general'),
            'priority': objective_data.get('priority', 'medium'),
            'target_date': objective_data.get('target_date'),
            'success_criteria': objective_data.get('success_criteria', []),
            'dependencies': objective_data.get('dependencies', []),
            'status': 'planned'
        }
        
        self.roadmap_data['objectives'].append(objective)
    
    def assess_current_state(self, assessment_data):
        """Evaluar estado actual de seguridad"""
        self.roadmap_data['current_state'] = {
            'assessment_date': datetime.now(),
            'overall_maturity': assessment_data.get('overall_maturity', 'ad_hoc'),
            'capabilities': assessment_data.get('capabilities', {}),
            'gaps': assessment_data.get('gaps', []),
            'strengths': assessment_data.get('strengths', []),
            'weaknesses': assessment_data.get('weaknesses', []),
            'threats': assessment_data.get('threats', []),
            'opportunities': assessment_data.get('opportunities', [])
        }
    
    def add_initiative(self, initiative_id, initiative_data):
        """Añadir iniciativa de seguridad"""
        initiative = {
            'initiative_id': initiative_id,
            'name': initiative_data['name'],
            'description': initiative_data['description'],
            'category': initiative_data.get('category', 'general'),
            'priority': initiative_data.get('priority', 'medium'),
            'start_date': initiative_data.get('start_date'),
            'end_date': initiative_data.get('end_date'),
            'duration_months': initiative_data.get('duration_months', 6),
            'budget_required': initiative_data.get('budget_required', 0),
            'resources_required': initiative_data.get('resources_required', []),
            'dependencies': initiative_data.get('dependencies', []),
            'success_metrics': initiative_data.get('success_metrics', []),
            'status': 'planned',
            'progress': 0
        }
        
        self.roadmap_data['initiatives'].append(initiative)
    
    def create_timeline(self, start_date, end_date):
        """Crear cronograma del roadmap"""
        self.roadmap_data['timeline'] = {
            'start_date': start_date,
            'end_date': end_date,
            'phases': self.define_phases(start_date, end_date),
            'milestones': self.define_milestones(),
            'dependencies': self.analyze_dependencies()
        }
    
    def define_phases(self, start_date, end_date):
        """Definir fases del roadmap"""
        total_duration = (end_date - start_date).days
        phase_duration = total_duration // 4  # 4 fases
        
        phases = [
            {
                'phase_id': 'phase_1',
                'name': 'Fundación',
                'start_date': start_date,
                'end_date': start_date + timedelta(days=phase_duration),
                'description': 'Establecer fundamentos de seguridad',
                'initiatives': []
            },
            {
                'phase_id': 'phase_2',
                'name': 'Desarrollo',
                'start_date': start_date + timedelta(days=phase_duration),
                'end_date': start_date + timedelta(days=phase_duration * 2),
                'description': 'Desarrollar capacidades de seguridad',
                'initiatives': []
            },
            {
                'phase_id': 'phase_3',
                'name': 'Optimización',
                'start_date': start_date + timedelta(days=phase_duration * 2),
                'end_date': start_date + timedelta(days=phase_duration * 3),
                'description': 'Optimizar y mejorar procesos',
                'initiatives': []
            },
            {
                'phase_id': 'phase_4',
                'name': 'Innovación',
                'start_date': start_date + timedelta(days=phase_duration * 3),
                'end_date': end_date,
                'description': 'Innovar y evolucionar',
                'initiatives': []
            }
        ]
        
        return phases
    
    def define_milestones(self):
        """Definir hitos del roadmap"""
        milestones = [
            {
                'milestone_id': 'milestone_1',
                'name': 'Gobierno de Seguridad Establecido',
                'target_date': datetime.now() + timedelta(days=90),
                'description': 'Estructura de gobierno de seguridad implementada',
                'success_criteria': [
                    'Políticas de seguridad aprobadas',
                    'Comités de seguridad activos',
                    'Roles y responsabilidades definidos'
                ]
            },
            {
                'milestone_id': 'milestone_2',
                'name': 'Controles Básicos Implementados',
                'target_date': datetime.now() + timedelta(days=180),
                'description': 'Controles de seguridad básicos en funcionamiento',
                'success_criteria': [
                    'Firewall configurado',
                    'Antivirus desplegado',
                    'Backup automatizado'
                ]
            },
            {
                'milestone_id': 'milestone_3',
                'name': 'Monitoreo Continuo Activo',
                'target_date': datetime.now() + timedelta(days=270),
                'description': 'Sistema de monitoreo continuo implementado',
                'success_criteria': [
                    'SIEM desplegado',
                    'Alertas configuradas',
                    'Dashboards operativos'
                ]
            },
            {
                'milestone_id': 'milestone_4',
                'name': 'Respuesta Automatizada',
                'target_date': datetime.now() + timedelta(days=365),
                'description': 'Capacidades de respuesta automatizada implementadas',
                'success_criteria': [
                    'SOAR implementado',
                    'Playbooks automatizados',
                    'Respuesta a incidentes mejorada'
                ]
            }
        ]
        
        return milestones
    
    def analyze_dependencies(self):
        """Analizar dependencias entre iniciativas"""
        dependencies = []
        
        for initiative in self.roadmap_data['initiatives']:
            for dep_id in initiative.get('dependencies', []):
                dependencies.append({
                    'from_initiative': dep_id,
                    'to_initiative': initiative['initiative_id'],
                    'type': 'finish_to_start',
                    'description': f"{dep_id} debe completarse antes de {initiative['initiative_id']}"
                })
        
        return dependencies
    
    def calculate_roadmap_metrics(self):
        """Calcular métricas del roadmap"""
        total_initiatives = len(self.roadmap_data['initiatives'])
        completed_initiatives = len([i for i in self.roadmap_data['initiatives'] if i['status'] == 'completed'])
        in_progress_initiatives = len([i for i in self.roadmap_data['initiatives'] if i['status'] == 'in_progress'])
        
        total_budget = sum(i.get('budget_required', 0) for i in self.roadmap_data['initiatives'])
        spent_budget = sum(i.get('budget_spent', 0) for i in self.roadmap_data['initiatives'])
        
        return {
            'total_initiatives': total_initiatives,
            'completed_initiatives': completed_initiatives,
            'in_progress_initiatives': in_progress_initiatives,
            'completion_rate': (completed_initiatives / total_initiatives * 100) if total_initiatives > 0 else 0,
            'total_budget': total_budget,
            'spent_budget': spent_budget,
            'budget_utilization': (spent_budget / total_budget * 100) if total_budget > 0 else 0
        }
    
    def generate_roadmap_report(self):
        """Generar reporte del roadmap"""
        metrics = self.calculate_roadmap_metrics()
        
        report = {
            'report_date': datetime.now(),
            'vision': self.roadmap_data['vision'],
            'current_state': self.roadmap_data['current_state'],
            'objectives': self.roadmap_data['objectives'],
            'initiatives': self.roadmap_data['initiatives'],
            'timeline': self.roadmap_data['timeline'],
            'metrics': metrics,
            'recommendations': self.generate_recommendations()
        }
        
        return report
    
    def generate_recommendations(self):
        """Generar recomendaciones basadas en el estado actual"""
        recommendations = []
        
        current_maturity = self.roadmap_data['current_state'].get('overall_maturity', 'ad_hoc')
        maturity_score = self.maturity_levels.get(current_maturity, {}).get('score', 1)
        
        if maturity_score < 3:
            recommendations.append("Establecer procesos de seguridad básicos")
            recommendations.append("Implementar controles de seguridad fundamentales")
            recommendations.append("Capacitar al personal en seguridad")
        
        if maturity_score < 4:
            recommendations.append("Implementar monitoreo continuo")
            recommendations.append("Establecer métricas de seguridad")
            recommendations.append("Mejorar la respuesta a incidentes")
        
        if maturity_score < 5:
            recommendations.append("Optimizar procesos existentes")
            recommendations.append("Implementar automatización")
            recommendations.append("Desarrollar capacidades avanzadas")
        
        return recommendations

# Ejemplo de uso
roadmap = SecurityRoadmap()

# Definir visión
roadmap.define_vision(
    "Ser una organización líder en ciberseguridad con capacidades avanzadas de protección y respuesta",
    "3 años"
)

# Añadir objetivos
roadmap.add_objective('OBJ-001', {
    'title': 'Implementar Zero Trust',
    'description': 'Implementar modelo de seguridad Zero Trust en toda la organización',
    'category': 'architecture',
    'priority': 'high',
    'target_date': datetime.now() + timedelta(days=365),
    'success_criteria': ['100% de usuarios con MFA', 'Segmentación de red completa']
})

# Evaluar estado actual
roadmap.assess_current_state({
    'overall_maturity': 'repeatable',
    'capabilities': {
        'firewall': 'implemented',
        'antivirus': 'implemented',
        'backup': 'implemented',
        'monitoring': 'partial'
    },
    'gaps': ['SIEM', 'SOAR', 'MFA', 'Network Segmentation'],
    'strengths': ['Políticas definidas', 'Personal capacitado'],
    'weaknesses': ['Monitoreo limitado', 'Respuesta manual']
})

# Añadir iniciativas
roadmap.add_initiative('INIT-001', {
    'name': 'Implementar SIEM',
    'description': 'Desplegar sistema de gestión de eventos de seguridad',
    'category': 'monitoring',
    'priority': 'high',
    'start_date': datetime.now(),
    'end_date': datetime.now() + timedelta(days=90),
    'budget_required': 100000,
    'success_metrics': ['Cobertura de logs 100%', 'Tiempo de detección < 1 hora']
})

# Crear cronograma
roadmap.create_timeline(
    datetime.now(),
    datetime.now() + timedelta(days=1095)  # 3 años
)

# Generar reporte
report = roadmap.generate_roadmap_report()
print(f"Reporte del roadmap: {len(report['initiatives'])} iniciativas planificadas")

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159

class ResourceManagement:
    def __init__(self):
        self.resources = {
            'human': [],
            'financial': [],
            'technological': [],
            'infrastructure': []
        }
        self.resource_allocations = {}
        self.budget_tracking = {}
    
    def add_human_resource(self, resource_id, resource_data):
        """Añadir recurso humano"""
        self.resources['human'].append({
            'resource_id': resource_id,
            'name': resource_data['name'],
            'role': resource_data['role'],
            'skills': resource_data.get('skills', []),
            'availability': resource_data.get('availability', 1.0),
            'cost_per_hour': resource_data.get('cost_per_hour', 0),
            'allocation': {}
        })
    
    def add_financial_resource(self, resource_id, resource_data):
        """Añadir recurso financiero"""
        self.resources['financial'].append({
            'resource_id': resource_id,
            'name': resource_data['name'],
            'total_budget': resource_data['total_budget'],
            'allocated_budget': 0,
            'remaining_budget': resource_data['total_budget'],
            'category': resource_data.get('category', 'general')
        })
    
    def allocate_resource(self, resource_id, initiative_id, allocation_data):
        """Asignar recurso a iniciativa"""
        if resource_id not in self.resource_allocations:
            self.resource_allocations[resource_id] = []
        
        allocation = {
            'initiative_id': initiative_id,
            'start_date': allocation_data['start_date'],
            'end_date': allocation_data['end_date'],
            'percentage': allocation_data['percentage'],
            'cost': allocation_data.get('cost', 0)
        }
        
        self.resource_allocations[resource_id].append(allocation)
        
        # Actualizar presupuesto asignado
        if resource_id.startswith('FIN-'):
            self.update_budget_allocation(resource_id, allocation['cost'])
    
    def update_budget_allocation(self, resource_id, cost):
        """Actualizar asignación de presupuesto"""
        for resource in self.resources['financial']:
            if resource['resource_id'] == resource_id:
                resource['allocated_budget'] += cost
                resource['remaining_budget'] -= cost
                break
    
    def calculate_resource_utilization(self, resource_id):
        """Calcular utilización de recurso"""
        if resource_id not in self.resource_allocations:
            return 0
        
        allocations = self.resource_allocations[resource_id]
        total_allocation = sum(a['percentage'] for a in allocations)
        
        return min(total_allocation, 1.0)  # Máximo 100%
    
    def get_resource_conflicts(self):
        """Obtener conflictos de recursos"""
        conflicts = []
        
        # Verificar sobreasignación de recursos humanos
        for resource in self.resources['human']:
            utilization = self.calculate_resource_utilization(resource['resource_id'])
            if utilization > 1.0:
                conflicts.append({
                    'type': 'over_allocation',
                    'resource_id': resource['resource_id'],
                    'resource_name': resource['name'],
                    'utilization': utilization,
                    'description': f"Recurso {resource['name']} está sobreasignado ({utilization:.1%})"
                })
        
        # Verificar presupuesto insuficiente
        for resource in self.resources['financial']:
            if resource['remaining_budget'] < 0:
                conflicts.append({
                    'type': 'budget_exceeded',
                    'resource_id': resource['resource_id'],
                    'resource_name': resource['name'],
                    'excess': abs(resource['remaining_budget']),
                    'description': f"Presupuesto {resource['name']} excedido por ${abs(resource['remaining_budget']):,.2f}"
                })
        
        return conflicts
    
    def optimize_resource_allocation(self):
        """Optimizar asignación de recursos"""
        optimization_suggestions = []
        
        # Sugerir reasignación de recursos sobreasignados
        for resource in self.resources['human']:
            utilization = self.calculate_resource_utilization(resource['resource_id'])
            if utilization > 0.8:  # 80% de utilización
                optimization_suggestions.append({
                    'type': 'resource_reallocation',
                    'resource_id': resource['resource_id'],
                    'suggestion': f"Considerar reasignar tareas de {resource['name']} (utilización: {utilization:.1%})"
                })
        
        # Sugerir ajustes de presupuesto
        for resource in self.resources['financial']:
            if resource['remaining_budget'] < resource['total_budget'] * 0.1:  # Menos del 10% restante
                optimization_suggestions.append({
                    'type': 'budget_adjustment',
                    'resource_id': resource['resource_id'],
                    'suggestion': f"Considerar aumentar presupuesto para {resource['name']} (restante: {resource['remaining_budget']:.2f})"
                })
        
        return optimization_suggestions

# Ejemplo de uso
resource_mgmt = ResourceManagement()

# Añadir recursos humanos
resource_mgmt.add_human_resource('HR-001', {
    'name': 'Juan Pérez',
    'role': 'Security Architect',
    'skills': ['Zero Trust', 'Network Security', 'Cloud Security'],
    'availability': 1.0,
    'cost_per_hour': 75
})

# Añadir recursos financieros
resource_mgmt.add_financial_resource('FIN-001', {
    'name': 'Security Technology Budget',
    'total_budget': 500000,
    'category': 'technology'
})

# Asignar recursos
resource_mgmt.allocate_resource('HR-001', 'INIT-001', {
    'start_date': datetime.now(),
    'end_date': datetime.now() + timedelta(days=90),
    'percentage': 0.5,
    'cost': 27000  # 90 días * 0.5 * 75 * 8 horas
})

# Verificar conflictos
conflicts = resource_mgmt.get_resource_conflicts()
print(f"Conflictos de recursos: {len(conflicts)}")

# Optimizar asignación
optimization = resource_mgmt.optimize_resource_allocation()
print(f"Sugerencias de optimización: {len(optimization)}")