Fatores influenciadores da implementação de ações de gestão de segurança da informação :um estudo com executivos e gerentes de tecnologia da informação das empresas do Rio Grande do Norte

Information is one of the most valuable organization s assets, mainly on a global and highly competitive world. On this scenery there are two antagonists forces: on one side, organizations struggle for keeping protected its information, specially those considered as strategic, on the other side, the invaders, leaded by innumerous reasons - such as hobby, challenge or one single protest with the intention of capturing and corrupting the information of other organizations. This thesis presents the descriptive results of one research that had as its main objective to identify which variables influence the Executives´ and CIOs´ perceptions toward Information Security. In addition, the research also identified the profile of Rio Grande do Norte s organizations and its Executives/CIOs concerning Information Security, computed the level of agreement of the respondents according to NBR ISO/IEC 17799 (Information technology Code of practice for information security management) on its dimension Access Control. The research was based on a model, which took into account the following variables: origin of the organization s capital, sector of production, number of PCs networked, number of employees with rights to network, number of attacks suffered by the organizations, respondent´s positions, education level, literacy on Information Technology and specific training on network. In the goal´s point of view, the research was classified as exploratory and descriptive, and, in relation of the approach, quantitative. One questionnaire was applied on 33 Executives and CIOs of the 50 Rio Grande do Norte s organizations that collected the highest taxes of ICMS - Imposto sobre Circulação de Mercadorias on 2000. After the data collecting, cluster analysis and chi-square statistical tools were used for data analysis. The research made clear that the Executives and CIOs of Rio Grande do Norte s organizations have low level of agreement concerning the rules of the NBR ISO/IEC 17799. It also made evident that the Executives and CIOs have its perception toward Information Security influenced by the number of PCs networked and by the number of attacks suffered by the organizations

Construção das capacidades organizacionais de tecnologia da informação no contexto dos sistemas institucionais integrados de gestão da UFRN

The IT capability is a organizational ability to perform activities of this role more effectively and an important mechanism in creating value. Its building process (stages of creation and development) occurs through management initiatives for improvement in the performance of their activities, using human resources and IT assets complementary responsible for the evolution of their organizational routines. This research deals with the IT capabilities related to SIG (integrated institutional management systems), built and deployed in UFRN (Universidade Federal do Rio Grande do Norte) to realization and control of administrative, academic and human resources activities. Since 2009, through cooperative agreements with federal and educational institutions of direct administration, UFRN has supported the implementation of these systems, currently involving more than 30 institutions. The present study aims to understand how IT capabilities, relevant in the design, implementation and dissemination of SIG, were built over time. This is a single case study of qualitative and longitudinal nature, performed by capturing, coding and analysis from secondary data and from semi-structured interviews conducted primarily with members of Superintenência de Informática, organizational unit responsible for SIG systems in UFRN. As a result, the technical, of internal relationship and external cooperation capabilities were identified as relevant in the successful trajectory of SIG systems, which have evolved in different ways. The technical capacity, initiated in 2004, toured the stages of creation and development until it reached the stage of stability in 2013, due to technological limits. Regarding the internal relationship capability, begun in 2006, it toured the stages of creation and development, having extended its scope of activities in 2009, being in development since then. Unlike the standard life cycle observed in the literature, the external cooperation capability was initiated by an intensity of initiatives and developments in the routines in 2009, which were decreasing to cease in 2013 in order to stabilize the technological infrastructure already created for cooperative institutions. It was still identified the start of cooperation in 2009 as an important event selection, responsible for changing or creating trajectories of evolution in all three capacities. The most frequent improvements initiatives were of organizational nature and the internal planning activity has been transformed over the routines of the three capabilities. Important resources and complementary assets have been identified as important for the realization of initiatives, such as human resources technical knowledge to the technical capabilities and external cooperation, and business knowledge, for all of them, as well as IT assets: the iproject application for control of development processes, and the document repository wiki. All these resources and complementary assets grew along the capacities, demonstrating its strategic value to SINFO/UFRN

A influência do processo de terceirização de tecnologia da informação na utilização dos modelos de contratação de serviços: um estudo de casos múltiplos

The change in the economic world and the emergence of Internet as a tool for communication and integration among the markets have forced organizations to adopt a different structure, process-oriented with a focus on information management. Thus, information technology has gained prominence in the organizational context, increasing its complexity and range of services provided by this function. Moreover, outsourcing has become an important model for flexible corporate structure, helping organizations to achieve better results when carrying out their activities and processes and be more competitive. To make the IT outsourcing, it is necessary to follow certain steps that range from strategic assessment to the management of outsourced service. Such steps can influence the form of contracting services, varying the types of service providers and contractors. Thus, the study aimed to identify how this IT outsourcing process influences the use of models for contracting services. For this, a study was conducted in multiple cases study involving two companies in Rio Grande do Norte State, specifically the health sector. Data collection was carried out with the CIOs of the companies surveyed through semi-structured interviews. According to the results obtained, it was found that the outsourcing process more structured influences the use of a more advanced contracting model. However, there are features found in these steps carrying more clearly this influence, as the goals pursued by outsourcing, the criteria used in selecting the supplier, a contract negotiation, how to transition services and the use of methods management, but can vary depending on the level of maturity in the relationship of the companies examined. Moreover, it was found that the use of contracting model may also influence how it is developed the IT outsourcing process, requiring or not its more formalized and organization

Aspectos do gerenciamento de riscos de tecnologia da informação nas empresas: um estudo de caso múltiplos

The information technology - IT- benefits have been more perceived during the last decades. Both IT and business managers are dealing with subjects like governance, IT-Business alignment, information security and others on their top priorities. Talking about governance, specifically, managers are facing it with a technical approach, that gives emphasis on protection against invasions, antivirus systems, access controls and others technical issues. The IT risk management, commonly, is faced under this approach, that means, has its importance reduced and delegated to IT Departments. On the last two decades, a new IT risk management perspective raised, bringing an holistic view of IT risk to the organization. According to this new perspective, the strategies formulation process should take into account the IT risks. With the growing of IT dependence on most of organizations, the necessity of a better comprehension about the subject becomes more clear. This work shows a study in three public organizations of the Pernambuco State that investigates how those organizations manage their IT risks. Structured interviews were made with IT managers, and later, analyzed and compared with conceptual categories found in the literature. The results shows that the IT risks culture and IT governance are weakly understood and implemented on those organizations, where there are not such an IT risk methodology formally defined, neither executed. In addition, most of practices suggested in the literature were found, even without an alignment with an IT risks management process

Práticas de governança de tecnologia da informação: um estudo de caso em empresas de telecomunicações do Rio Grande do Norte

This study aims to understand the general model of governance of information technology adopted by telecommunication companies operating in Rio Grande do Norte. The research methodology used involved a theoretical and empirical approach prepared, involving two case studies on companies in the telecommunications industry working in the state of Rio Grande do Norte. The study covered the area of IT organizations, through interviews with managers responsible for the area of Telecommunications / IT. To study in accordance with the approach and address the problem of research, this study was based on qualitative criteria, which enabled the understanding of how companies adopt the governance of information technology. In conclusion, it was found that the governance practices of information technology employees are incipient, but that meet the needs of business and that they intend to implement in specific areas and use other practices of IT governance

A Tecnologia da informação como fator de competitividade em um apl: o caso da carcinicultura do RN

Este estudo aborda a utilização da tecnologia da informação de forma competitiva em um Arranjo Produtivo Local APL. Realizou-se no APL da carcinicultura no Estado do Rio Grande do Norte e teve por objetivo buscar a compreensão de como o uso da tecnologia da informação (TI) contribui para o aumento da competitividade na atividade do APL citado. APL pode ser conceituado como uma aliança entre organizações que possuem um projeto coletivo, para elevar a sua competitividade e participação no mercado. Para atingir este objetivo, foi realizada uma pesquisa descritiva, através da utilização de múltiplos casos selecionados dentre as empresas que compõem o APL da carcinicultura no RN. Os dados coletados foram analisados qualitativamente. Os resultados da pesquisa indicaram que as empresas percebem a importância do uso da TI, mas que, na prática, a sua utilização é limitada, principalmente em se tratando de Sistemas Integrados de Gestão e Comércio Eletrônico. Outro resultado encontrado foi que as empresas, embora façam parte do APL, ainda não colaboram entre si, seja através da troca de informações, ou através de Sistemas de Informação Interorganizacional. As principais recomendações diante destes resultados é que as empresas atuem ativamente para o fortalecimento do APL. No que se refere ao uso da TI faz-se necessário que elas invistam na aquisição de sistemas integrados de gestão e sistemas de informação interorganizacional para o melhor gerenciamento das informações ao longo da cadeia

Terceirização em tecnologia da informação sob os aspectos de estratégia, tomada de decisão e análise de investimentos :estudo de múltiplos casos em três organizações franqueadas da Coca-Cola do Brasil

Desde a criação da tecnologia e do seu uso pelas empresas, a relação custo e benefício nem sempre foi bem elucidada tanto para os responsáveis pela área de tecnologia quanto para a alta direção. Mas, apesar disto, cada vez mais as organizações investem maciçamente em tecnologia, esperando que esta seja a solução para diversos problemas. Por isto, esta questão tem se tornado crucial para o processo de tomada de decisões, visto que investimentos nesta área costumam ser dispendiosos e, na atual conjuntura, estas análises precisam ser extremamente criteriosas para que se miniminizem as possibilidades de insucesso dos projetos, principalmente numa economia estabilizada e de concorrência acirrada. Uma das alternativas que as empresas têm buscado para atingir o sucesso e correr menos riscos é a terceirização da área de TI. Partindo desta visão, a presente dissertação tem por objetivo realizar uma investigação sobre a terceirização dos serviços de TI em todos os seus aspectos, isto é, desde a sua motivação, serviços efetivamente terceirizados, vantagens, desvantagens e possíveis obstáculos, a visão do alinhamento estratégico da TI, os processos de gestão de contratos e formas de controle e, por fim, tendências futuras. Trata-se de uma pesquisa de múltiplos casos, envolvendo franquias do Sistema Coca-Cola no Brasil. O estudo apresenta uma pesquisa bibliográfica sobre o processo de tomada de decisão empresarial, a análise de investimentos, a gestão e a terceirização da TI, o que permitem definir as dimensões de análise da pesquisa. Na pesquisa de campo foram entrevistados os gerentes da área de TI, nas cidades de Brasília-DF, Goiânia-GO e Ribeirão Preto-SP. A pesquisa de campo permitiu identificar como as mesmas avaliam seus investimentos em TI, como esta área é gerenciada, o que as levou a optar pela terceirização e como os processos terceirizados afetam a organização. Por se tratar de uma pesquisa qualitativa, optou-se por analisar comparativamente as três organizações. Com a realização deste estudo, obtiveram-se, como principais resultados, que as organizações estão utilizando a terceirização em TI para focar no negócio principal e, mesmo encontrando diversas desvantagens, inclusive com relação a custos, acreditam que os benefícios justificam. Ainda identificaram-se alguns obstáculos internos para a terceirização, principalmente quanto ao receio de se perder a inteligência do negócio. O acompanhamento dessas atividades terceirizadas é realizado pela equipe interna e por critérios estruturados, onde se verificam os níveis de serviço

Pressupostos ontológicos para se pensar a nova tecnologia: técnica, informação e ser e tempo

La recherche presentée, realisée sur le domaine de la méthaphysique, s´agit de rassembler des pressupositions pour une fondamentation ontologique de la technologie de l´Information, basé sur la philophie de Martin Heidegger; foncièrement, sur l´analytique existentiel du Dasein dans l´ouvrage Être et Temps. À partir de la pensée sur ce qui est aujourd´hui , il s´agit d´investiguer sur quels fondaments la Nouvelle Tecnologie se fut érigée de façon a que nous sommes engajés au projet de numérisation des étants que en même temps que destine l´homme a l´oubli de l´Être, l´offre la possibilité de transformation. Le rapport entre la question de l´Être et la question de la technique est analysé comme des chemins croisés et dans ce carrefour il devient possible penser ce qui est technique, ce qui est information pour Heidegger et de quel façon les modes existentiels du Dasein sont prêtes pour caractériser l ´homme au sein de la tecnologie de l´information. Par cette appropriation, il reste penser comment c´est possible l´ouverture d´une perspective de reconduction de l´homme à la vérité de l´Être. Finalement, la structuration des fondements rends possible la réflexion discursive général: avec qui nous nous ocuppons, comme nous sommes, dans quelle direction nous nous acheminons, les thèmes générales, respectivement, des trois chapitres. Les points d´investigation du premier chapitre son: a) La caractérisation précise du Dasein, appuyé sur des considerations de Benedito Nunes, Hans-Georg Gadamer, Jacques Derrida et Rüdiger Safränski; b) Le concept de technique et son essence chez Heidegger; c) la distinction entre technique et technologie, appuyé sur le pensée de J. Ellul, Michel Séris, Otto Pöggeler, Michel Haar, Dominique Janicaud; c) Le concept de cibernetique chez Heidegger et chez Norbert Wiener; d) La caractérisation preliminaire d´information, l´analyse étimologique e philosophique, l´avis de Heidegger te les théories de Rafael Capurro; f) L´Analyse du phénomène de la numérisation des étants, des considérations de Virilio, et l´analyse d´un concept de virtuel avec Henri Bergson et Gilles Deleuze. Dans le deuxième chapitre, l´analyse des existentiels du Dasein vers le sommaire des fondements de base pour la caractérisation de la technologie de l´information comme un problème philosophique. Finalement, aprés avoir presenté les concepts introdutoires que délimitent le questionement, suivi par les indications et pressupositions ontologiques trouvés sur Être et Temps, le troisième chapitre disserte sur le péril, ce qui sauve et la sérénité, les trois mots-clés de la pensée heideggerienne sur la technique que permettent l´approche conclusif de la question

Diagnóstico do usuário no aprimoramento dos serviços de tecnologia da informação: um projeto de intervenção para o Ministério Público do Estado do Rio Grande do Norte

The information tecnology (IT) has, over the years, gaining prominence as a strategic element and competitive edge in organizations, public or private. In the judiciary, with the implementation of actions related to Judiciário Eletrônico, information technology (IT), definitely earns its status as a strategic element and significantly raises the level of dependence of the organs of their services and products. Increasingly, the quality of services provided by IT has direct impact on the quality of services provided by the agency as a whole. The Ministério Público do Estado do Rio Grande do Norte (MPRN) deployments shares of Electronic Government, along with an administrative reform, beyond these issues raised, caused a large increase in institutional demand for products and services provided by the Diretoria de Tecnologia da Informação (DTI), a sector responsible for the provision of IT services. Taking as starting point strategic goal set by MPRN to reach a 85% level of user satisfaction in four years, we seek to propose a method that assists in meeting the goal, respecting the capacity constraints of the IT sector. To achieve the proposed objective, we conducted a work in two distinct and complementary stages. In the first step we conducted a case study in MPRN, in which, through an internal and external diagnosis of DTI, accomplished by an action of internal consulting and one research of the user satisfaction, we seek to identify opportunities of change seeking to raise the quality perceived of the services provided by the DTI , from the viewpoint of their customers. The situational report, drawn from the data collected, fostered changes in DTI, which were then evaluated with the managers. In the second stage, with the results obtained in the initial process, empirical observation, evaluation of side projects of quality improvement in the sector, and validation with the managers, of the initial model, we developed an improved process, gazing beyond the identification of gaps in service a strategy for the selection of best management practices and deployment of these, in a incremental and adaptive way, allowing the application of the process in organs with little staff allocated to the provision of information technology services

Prospecção e formação no domínio das competências e habilidades em tecnologia da informação: o caso do projeto metrópole digital em Natal/RN

This study deals with cognitive competences and abilities that are relevant to selection and education regarding Information Technology (IT). These competences relate to problem solving, decision making, and practical intelligence that regard scholar and extracurricular knowledge mobilization. The research aimed to contribute for the improvement of a selection instrument, consisting of five arrays of skills (dealing with objectives and prospection), as well as the development and comprehension of those skills that are involved in IT education. This is done by means of an analysis on the selection instrument used in the first selective process that occurred at Metropole Digital an Institute at the Federal University of Rio Grande do Norte in Brazil. This was evaluated aiming to acknowledge IT education (with basic training and emphasis on Web programming and electronics). The methodology used was of quantitative method involving performance scores relating education delivery. An Anova analysis of variance was done along with descriptive analysis involving socioeconomic data that was not observed in the meaningful relations between parental instruction and student performance in the graduate course. These analyses were able to point out the importance and need of the policies for vacancy reservation on behalf of public school students. A Spearman correlation analysis was done considering the instrument selection performance in the training course. The instrument is presented as a predictor that is significantly moderate and presents a good performance in the course as a whole. A Cluster and Regression analysis was also realized in the process. The first analysis allowed finding performance groups (Clusters) that ranged from medium and inferior. The regression analysis was able to point out association amongst criterion variables and the (average performance in basic and advanced modules) and explanatory (five matrixes). Regression analysis indicated that matrix 1 and matrix 3 were pointed out as being the strongest ones. In all the above analysis, the correlation between the instrument and the course was considered moderate. Thus this can be related in some of the aspects present in the course such as emphasis on evaluation itself as well as in technical contents and practical skills (educational ones) and competences and selection skills. It is known that the mediation of technological artifact in cultural context can foster the development of skills and abilities relevant to IT training. This study provides subsidies to reflect on the adoption of selection instrument and IT training in the Institute. Thus the research offers means to achieve a interdisciplinary discussion and enriching of areas such as Psychology and Information Technology; all of which regarding competencies and skills relevant in IT training

Uma abordagem para promover o alinhamento entre a estratégia de negócio e a tecnologia de informação

Currently with the increase in complexity in doing business, organizations are seeking information systems that help to quickly respond to new demands in the processes of production of products and services. An information system is no longer just a support tool and has become an integral part of doing business. However, in spite of significant technological evolution in recent years, information systems that support business do not respond efficiently to the constant alterations that occur in many organizations. One of the main problems faced by information systems currently is the lack of strategic alignment between business strategy and information technology. The concept of strategic alignment can be defined as a way between business strategies and objectives and the strategies, objectives and functions of information technology in such as way as to contribute to the increase in competitivity of the organization over time. Strategic alignment together with strategic planning are important management instruments. Approaches for operationalizing this alignment are being developed currently but are still in their initial stages due to the fact that it is a relatively new concept in the literature. Another point that needs to be taken into consideration during the strategic alignment is the question of trackability between the business elements and IT. Trackability (Tracking) is necessary for example when one wishes to know exactly which goal defined in the business strategy was left out or not accepted due to a modification made in the IT strategy. Very few proposals present concrete ways supported by software systems in order to obtain strategic alignement while taking into consideration this trackability. Therefore the objective of this work is to propose the creation of a strategic alignment process supported by a software system which is capable of permitting trackability between the organizational objectives and the business processes based on formalization standards defined through a model oriented approach

Metodologia para gerenciamento de projetos em tecnologia da informação baseada no guia PMBOK: um estudo de caso na Secretaria de Estado da Saúde Pública do Rio Grande do Norte

Nowadays the search for growth makes organizations seeking competitive advantages, project management shares this goal, through techniques that assist in the search for an improved management of the various fields of knowledge through a design methodology. The world is driven by projects and the search for ways to better manage activities such as time, cost and term towards the success of a particular project is something constant. A major contribution that IT can make to the health sector is the support for the management area. IT can integrate processes, optimize the interconnection between the various sectors, make hospitals have access to inside information of good quality, as well as support in the healthcare area, sharing pictures, uniting the various aspects of nursing and nursing service. The major challenge faced by the SESAP Information Technology sector at present is in project management in IT , which does not exist makes investments in the area are increasingly difficult due to this deficiency in management develop their own systems without cost additional to the State. This study seeks to build and strengthen the Project Management within the Department of Health through the implementation of a project office that will manage the final result of this work methodology based on PMBOK, and still show the functionality applied to development the state Hospital Management System that will later be installed on all Regional Health Units and proposing measures for the sustainability and development of the sector amid the difficulties of the current public service. Such action will result in a savings of more than R$ 107,000.00 (one hundred seven thousand) regarding spending private software currently used by the assignment of invested by the State of Rio Grande do Norte user licenses, representing more than 5 % of the total budget of the State Department of Public Health of the State

Construção das capacidades organizacionais de tecnologia da informação no contexto dos sistemas institucionais integrados de gestão da UFRN

The IT capability is a organizational ability to perform activities of this role more effectively and an important mechanism in creating value. Its building process (stages of creation and development) occurs through management initiatives for improvement in the performance of their activities, using human resources and IT assets complementary responsible for the evolution of their organizational routines. This research deals with the IT capabilities related to SIG (integrated institutional management systems), built and deployed in UFRN (Universidade Federal do Rio Grande do Norte) to realization and control of administrative, academic and human resources activities. Since 2009, through cooperative agreements with federal and educational institutions of direct administration, UFRN has supported the implementation of these systems, currently involving more than 30 institutions. The present study aims to understand how IT capabilities, relevant in the design, implementation and dissemination of SIG, were built over time. This is a single case study of qualitative and longitudinal nature, performed by capturing, coding and analysis from secondary data and from semi-structured interviews conducted primarily with members of Superintenência de Informática, organizational unit responsible for SIG systems in UFRN. As a result, the technical, of internal relationship and external cooperation capabilities were identified as relevant in the successful trajectory of SIG systems, which have evolved in different ways. The technical capacity, initiated in 2004, toured the stages of creation and development until it reached the stage of stability in 2013, due to technological limits. Regarding the internal relationship capability, begun in 2006, it toured the stages of creation and development, having extended its scope of activities in 2009, being in development since then. Unlike the standard life cycle observed in the literature, the external cooperation capability was initiated by an intensity of initiatives and developments in the routines in 2009, which were decreasing to cease in 2013 in order to stabilize the technological infrastructure already created for cooperative institutions. It was still identified the start of cooperation in 2009 as an important event selection, responsible for changing or creating trajectories of evolution in all three capacities. The most frequent improvements initiatives were of organizational nature and the internal planning activity has been transformed over the routines of the three capabilities. Important resources and complementary assets have been identified as important for the realization of initiatives, such as human resources technical knowledge to the technical capabilities and external cooperation, and business knowledge, for all of them, as well as IT assets: the iproject application for control of development processes, and the document repository wiki. All these resources and complementary assets grew along the capacities, demonstrating its strategic value to SINFO/UFRN

A influência do processo de terceirização de tecnologia da informação na utilização dos modelos de contratação de serviços: um estudo de casos múltiplos

The change in the economic world and the emergence of Internet as a tool for communication and integration among the markets have forced organizations to adopt a different structure, process-oriented with a focus on information management. Thus, information technology has gained prominence in the organizational context, increasing its complexity and range of services provided by this function. Moreover, outsourcing has become an important model for flexible corporate structure, helping organizations to achieve better results when carrying out their activities and processes and be more competitive. To make the IT outsourcing, it is necessary to follow certain steps that range from strategic assessment to the management of outsourced service. Such steps can influence the form of contracting services, varying the types of service providers and contractors. Thus, the study aimed to identify how this IT outsourcing process influences the use of models for contracting services. For this, a study was conducted in multiple cases study involving two companies in Rio Grande do Norte State, specifically the health sector. Data collection was carried out with the CIOs of the companies surveyed through semi-structured interviews. According to the results obtained, it was found that the outsourcing process more structured influences the use of a more advanced contracting model. However, there are features found in these steps carrying more clearly this influence, as the goals pursued by outsourcing, the criteria used in selecting the supplier, a contract negotiation, how to transition services and the use of methods management, but can vary depending on the level of maturity in the relationship of the companies examined. Moreover, it was found that the use of contracting model may also influence how it is developed the IT outsourcing process, requiring or not its more formalized and organization

Aspectos do gerenciamento de riscos de tecnologia da informação nas empresas: um estudo de caso múltiplos

The information technology - IT- benefits have been more perceived during the last decades. Both IT and business managers are dealing with subjects like governance, IT-Business alignment, information security and others on their top priorities. Talking about governance, specifically, managers are facing it with a technical approach, that gives emphasis on protection against invasions, antivirus systems, access controls and others technical issues. The IT risk management, commonly, is faced under this approach, that means, has its importance reduced and delegated to IT Departments. On the last two decades, a new IT risk management perspective raised, bringing an holistic view of IT risk to the organization. According to this new perspective, the strategies formulation process should take into account the IT risks. With the growing of IT dependence on most of organizations, the necessity of a better comprehension about the subject becomes more clear. This work shows a study in three public organizations of the Pernambuco State that investigates how those organizations manage their IT risks. Structured interviews were made with IT managers, and later, analyzed and compared with conceptual categories found in the literature. The results shows that the IT risks culture and IT governance are weakly understood and implemented on those organizations, where there are not such an IT risk methodology formally defined, neither executed. In addition, most of practices suggested in the literature were found, even without an alignment with an IT risks management process