Tratamiento de Riesgos

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91

class ControlManagementSystem:
    def __init__(self):
        self.controls = {}
        self.control_categories = {
            'Preventive': 'Controles que previenen incidentes',
            'Detective': 'Controles que detectan incidentes',
            'Corrective': 'Controles que corrigen incidentes',
            'Compensating': 'Controles que compensan otros controles'
        }
        
        self.control_types = {
            'Administrative': 'Políticas, procedimientos, capacitación',
            'Technical': 'Software, hardware, sistemas',
            'Physical': 'Barreras físicas, acceso, ambiente'
        }
    
    def add_control(self, control_id, control_data):
        """Añadir control de seguridad"""
        self.controls[control_id] = {
            **control_data,
            'status': 'Planned',
            'effectiveness': 0,
            'cost': 0,
            'implementation_date': None,
            'last_review': None
        }
    
    def implement_control(self, control_id, implementation_date):
        """Implementar control"""
        if control_id in self.controls:
            self.controls[control_id]['status'] = 'Implemented'
            self.controls[control_id]['implementation_date'] = implementation_date
    
    def assess_control_effectiveness(self, control_id, effectiveness_score):
        """Evaluar efectividad del control"""
        if control_id in self.controls:
            self.controls[control_id]['effectiveness'] = effectiveness_score
            self.controls[control_id]['last_review'] = '2025-10-26'
    
    def get_controls_by_category(self, category):
        """Obtener controles por categoría"""
        return [cid for cid, control in self.controls.items() 
                if control.get('category') == category]
    
    def calculate_control_roi(self, control_id):
        """Calcular ROI del control"""
        if control_id not in self.controls:
            return None
        
        control = self.controls[control_id]
        cost = control.get('cost', 0)
        effectiveness = control.get('effectiveness', 0)
        
        if cost == 0:
            return float('inf')
        
        # ROI simplificado: efectividad / costo
        roi = effectiveness / cost
        return roi

# Ejemplo de uso
control_system = ControlManagementSystem()

# Añadir controles
control_system.add_control('CTRL-001', {
    'name': 'Firewall',
    'category': 'Preventive',
    'type': 'Technical',
    'description': 'Firewall de red para filtrar tráfico',
    'cost': 50000,
    'effectiveness': 0.8
})

control_system.add_control('CTRL-002', {
    'name': 'Security Awareness Training',
    'category': 'Preventive',
    'type': 'Administrative',
    'description': 'Capacitación en seguridad para empleados',
    'cost': 20000,
    'effectiveness': 0.6
})

# Implementar control
control_system.implement_control('CTRL-001', '2025-10-26')

# Calcular ROI
firewall_roi = control_system.calculate_control_roi('CTRL-001')
training_roi = control_system.calculate_control_roi('CTRL-002')

print(f"ROI Firewall: {firewall_roi:.4f}")
print(f"ROI Training: {training_roi:.4f}")

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

import numpy as np
import pandas as pd

class CostBenefitAnalysis:
    def __init__(self):
        self.risk_scenarios = {}
        self.control_options = {}
        self.analysis_results = {}
    
    def add_risk_scenario(self, scenario_id, scenario_data):
        """Añadir escenario de riesgo"""
        self.risk_scenarios[scenario_id] = {
            **scenario_data,
            'annual_frequency': scenario_data.get('annual_frequency', 0.1),
            'impact_cost': scenario_data.get('impact_cost', 100000),
            'current_controls': scenario_data.get('current_controls', [])
        }
    
    def add_control_option(self, control_id, control_data):
        """Añadir opción de control"""
        self.control_options[control_id] = {
            **control_data,
            'implementation_cost': control_data.get('implementation_cost', 0),
            'annual_cost': control_data.get('annual_cost', 0),
            'risk_reduction': control_data.get('risk_reduction', 0.5)
        }
    
    def calculate_annual_loss_expectancy(self, scenario_id):
        """Calcular ALE para escenario"""
        if scenario_id not in self.risk_scenarios:
            return None
        
        scenario = self.risk_scenarios[scenario_id]
        ale = scenario['annual_frequency'] * scenario['impact_cost']
        return ale
    
    def calculate_control_effectiveness(self, scenario_id, control_id):
        """Calcular efectividad del control"""
        if scenario_id not in self.risk_scenarios or control_id not in self.control_options:
            return None
        
        scenario = self.risk_scenarios[scenario_id]
        control = self.control_options[control_id]
        
        # ALE sin control
        ale_without = self.calculate_annual_loss_expectancy(scenario_id)
        
        # ALE con control
        risk_reduction = control['risk_reduction']
        ale_with = ale_without * (1 - risk_reduction)
        
        # Beneficio del control
        benefit = ale_without - ale_with
        
        # Costo del control
        cost = control['implementation_cost'] + control['annual_cost']
        
        # ROI
        roi = (benefit - cost) / cost if cost > 0 else float('inf')
        
        return {
            'ale_without_control': ale_without,
            'ale_with_control': ale_with,
            'benefit': benefit,
            'cost': cost,
            'roi': roi,
            'net_benefit': benefit - cost
        }
    
    def compare_control_options(self, scenario_id, control_ids):
        """Comparar opciones de control"""
        comparison = []
        
        for control_id in control_ids:
            effectiveness = self.calculate_control_effectiveness(scenario_id, control_id)
            if effectiveness:
                comparison.append({
                    'control_id': control_id,
                    'control_name': self.control_options[control_id]['name'],
                    'net_benefit': effectiveness['net_benefit'],
                    'roi': effectiveness['roi'],
                    'cost': effectiveness['cost']
                })
        
        # Ordenar por beneficio neto
        comparison.sort(key=lambda x: x['net_benefit'], reverse=True)
        
        return comparison

# Ejemplo de uso
cba = CostBenefitAnalysis()

# Añadir escenario de riesgo
cba.add_risk_scenario('SCEN-001', {
    'name': 'Data Breach',
    'annual_frequency': 0.2,
    'impact_cost': 500000,
    'description': 'Brecha de datos confidenciales'
})

# Añadir opciones de control
cba.add_control_option('CTRL-001', {
    'name': 'Advanced Firewall',
    'implementation_cost': 100000,
    'annual_cost': 20000,
    'risk_reduction': 0.6
})

cba.add_control_option('CTRL-002', {
    'name': 'Employee Training',
    'implementation_cost': 50000,
    'annual_cost': 10000,
    'risk_reduction': 0.3
})

cba.add_control_option('CTRL-003', {
    'name': 'Data Encryption',
    'implementation_cost': 75000,
    'annual_cost': 15000,
    'risk_reduction': 0.4
})

# Comparar opciones
comparison = cba.compare_control_options('SCEN-001', ['CTRL-001', 'CTRL-002', 'CTRL-003'])
print(f"Comparación de controles: {comparison}")

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104

class RiskTreatmentPlan:
    def __init__(self):
        self.treatment_plans = {}
        self.implementation_timeline = {}
        self.responsibilities = {}
        self.budget_allocations = {}
    
    def create_treatment_plan(self, plan_id, risk_id, treatment_strategy, details):
        """Crear plan de tratamiento"""
        self.treatment_plans[plan_id] = {
            'plan_id': plan_id,
            'risk_id': risk_id,
            'strategy': treatment_strategy,
            'details': details,
            'status': 'Draft',
            'created_date': '2025-10-26',
            'target_completion': None,
            'actual_completion': None,
            'budget_required': 0,
            'budget_allocated': 0
        }
    
    def set_implementation_timeline(self, plan_id, start_date, end_date, milestones):
        """Establecer cronograma de implementación"""
        self.implementation_timeline[plan_id] = {
            'start_date': start_date,
            'end_date': end_date,
            'milestones': milestones,
            'status': 'Scheduled'
        }
    
    def assign_responsibility(self, plan_id, responsible_party, role):
        """Asignar responsabilidad"""
        self.responsibilities[plan_id] = {
            'responsible_party': responsible_party,
            'role': role,
            'assigned_date': '2025-10-26'
        }
    
    def allocate_budget(self, plan_id, budget_amount, budget_source):
        """Asignar presupuesto"""
        self.budget_allocations[plan_id] = {
            'amount': budget_amount,
            'source': budget_source,
            'allocated_date': '2025-10-26',
            'status': 'Allocated'
        }
        
        # Actualizar plan
        if plan_id in self.treatment_plans:
            self.treatment_plans[plan_id]['budget_allocated'] = budget_amount
    
    def get_plan_summary(self, plan_id):
        """Obtener resumen del plan"""
        if plan_id not in self.treatment_plans:
            return None
        
        plan = self.treatment_plans[plan_id]
        timeline = self.implementation_timeline.get(plan_id, {})
        responsibility = self.responsibilities.get(plan_id, {})
        budget = self.budget_allocations.get(plan_id, {})
        
        return {
            'plan_id': plan_id,
            'risk_id': plan['risk_id'],
            'strategy': plan['strategy'],
            'status': plan['status'],
            'timeline': timeline,
            'responsible': responsibility,
            'budget': budget
        }
    
    def get_plans_by_strategy(self, strategy):
        """Obtener planes por estrategia"""
        return [plan_id for plan_id, plan in self.treatment_plans.items() 
                if plan['strategy'] == strategy]

# Ejemplo de uso
treatment_plan = RiskTreatmentPlan()

# Crear plan de mitigación
treatment_plan.create_treatment_plan('PLAN-001', 'RISK-001', 'Mitigate', {
    'description': 'Implementar firewall avanzado',
    'controls': ['CTRL-001', 'CTRL-002'],
    'expected_effectiveness': 0.8
})

# Establecer cronograma
treatment_plan.set_implementation_timeline('PLAN-001', '2025-11-01', '2025-12-31', [
    {'milestone': 'Procurement', 'date': '2025-11-15'},
    {'milestone': 'Installation', 'date': '2025-12-01'},
    {'milestone': 'Testing', 'date': '2025-12-15'},
    {'milestone': 'Go-live', 'date': '2025-12-31'}
])

# Asignar responsabilidad
treatment_plan.assign_responsibility('PLAN-001', 'IT Manager', 'Implementation Lead')

# Asignar presupuesto
treatment_plan.allocate_budget('PLAN-001', 150000, 'Security Budget')

# Obtener resumen
summary = treatment_plan.get_plan_summary('PLAN-001')
print(f"Resumen del plan: {summary}")

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108

class RiskTreatmentMonitoring:
    def __init__(self):
        self.monitoring_metrics = {}
        self.kpis = {}
        self.alerts = {}
        self.reports = {}
    
    def define_kpi(self, kpi_id, kpi_data):
        """Definir KPI de tratamiento de riesgos"""
        self.kpis[kpi_id] = {
            **kpi_data,
            'current_value': 0,
            'target_value': kpi_data.get('target_value', 0),
            'status': 'Green',
            'last_updated': None
        }
    
    def update_kpi(self, kpi_id, current_value, update_date):
        """Actualizar valor de KPI"""
        if kpi_id in self.kpis:
            self.kpis[kpi_id]['current_value'] = current_value
            self.kpis[kpi_id]['last_updated'] = update_date
            
            # Determinar estado
            target = self.kpis[kpi_id]['target_value']
            if current_value >= target:
                self.kpis[kpi_id]['status'] = 'Green'
            elif current_value >= target * 0.8:
                self.kpis[kpi_id]['status'] = 'Yellow'
            else:
                self.kpis[kpi_id]['status'] = 'Red'
    
    def create_alert(self, alert_id, alert_data):
        """Crear alerta de monitoreo"""
        self.alerts[alert_id] = {
            **alert_data,
            'status': 'Active',
            'created_date': '2025-10-26',
            'resolved_date': None
        }
    
    def generate_monitoring_report(self, report_id, kpi_ids, alert_ids):
        """Generar reporte de monitoreo"""
        report = {
            'report_id': report_id,
            'generated_date': '2025-10-26',
            'kpis': {},
            'alerts': {},
            'summary': {}
        }
        
        # Incluir KPIs
        for kpi_id in kpi_ids:
            if kpi_id in self.kpis:
                report['kpis'][kpi_id] = self.kpis[kpi_id]
        
        # Incluir alertas
        for alert_id in alert_ids:
            if alert_id in self.alerts:
                report['alerts'][alert_id] = self.alerts[alert_id]
        
        # Generar resumen
        total_kpis = len(report['kpis'])
        green_kpis = len([k for k in report['kpis'].values() if k['status'] == 'Green'])
        active_alerts = len([a for a in report['alerts'].values() if a['status'] == 'Active'])
        
        report['summary'] = {
            'total_kpis': total_kpis,
            'green_kpis': green_kpis,
            'kpi_performance': green_kpis / total_kpis if total_kpis > 0 else 0,
            'active_alerts': active_alerts
        }
        
        self.reports[report_id] = report
        return report

# Ejemplo de uso
monitoring = RiskTreatmentMonitoring()

# Definir KPIs
monitoring.define_kpi('KPI-001', {
    'name': 'Risk Reduction Percentage',
    'description': 'Porcentaje de reducción de riesgo',
    'target_value': 80,
    'unit': 'Percentage'
})

monitoring.define_kpi('KPI-002', {
    'name': 'Control Implementation Rate',
    'description': 'Tasa de implementación de controles',
    'target_value': 95,
    'unit': 'Percentage'
})

# Actualizar KPIs
monitoring.update_kpi('KPI-001', 75, '2025-10-26')
monitoring.update_kpi('KPI-002', 90, '2025-10-26')

# Crear alerta
monitoring.create_alert('ALERT-001', {
    'type': 'KPI Below Target',
    'description': 'Risk reduction below target',
    'severity': 'Medium'
})

# Generar reporte
report = monitoring.generate_monitoring_report('RPT-001', ['KPI-001', 'KPI-002'], ['ALERT-001'])
print(f"Reporte de monitoreo: {report['summary']}")