Segurança da informação aplicada no modelo SECI : desenvolvimento de um framework de gestão do conhecimento seguro

Abstract

Due to the strategic importance of knowledge, it is necessary for organizations to adopt management methodologies that facilitate the creation and dissemination of knowledge but that also consider good security practices and suitability of processes to laws such as the General Law for the Protection of Personal Data (LGPD) and the General Data Protection Regulation (GDPR). Thus, the purpose of this study was to develop a Secure Knowledge Management framework, considering the points of consensus between the knowledge spiral of the SECI (Socialization, Externalization, Combination, Internalization) model and the security controls proposed by ISO27001. In order to do so, a survey was carried out using the Delphi methodology with the consultation of 20 specialists, 10 from each area. At the end of three rounds, a framework that highlights the security controls proposed in each phase of the SECI model was obtained. The control of Awareness, education and training in Information Security appears in the stages of Socialization, Externalization and Internalization of the SECI with 80% of votes or more. In the Combination stage, the most consensus control is Labels and information handling, which reached 75% of vote consensus. The implementation of this framework can be carried out through systematization and periodization of training of company employees on the topic of Information Security applied in Knowledge Management, supported by information and knowledge labels. It was also observed that there is a knowledge gap on topics that are opposite to the specialty of each specialist involved in the research. [resumo fornecido pelo autor]