Julio López Fenner

Cybersecurity maturity models, such as NIST CSF, C2M2 and ISO 27001, offer structured frameworks to evaluate organizational security postures. However, these models often fail to provide actionable and prioritized roadmaps to improve cybersecurity practices. To address this limitation, we introduce a scalable, service-oriented platform that operationalizes the AIM Triad - a context-aware strategy that encompasses Awareness, Infrastructure, and Management - to facilitate systematic improvements in cybersecurity maturity. Unlike conventional approaches, the platform generates two distinct outputs: standards-compliant assessment reports aligned with frameworks like C2M2, and customized, prioritized action plans tailored to organizational requirements. The system is built on a microservice architecture utilizing Vue.js, NestJS, and Flask, with Kubernetes orchestration ensuring modular adaptability across multiple maturity frameworks while maintaining scalability and resilience. Our proposed platform incorporates custom prioritization of security actions based on organizational needs, automated simulation of maturity assessments through a model-agnostic engine, and PDFbased reporting to support compliance and strategic planning. By bridging the gap between diagnostic evaluations and executable strategies, the platform serves as a blueprint for next-generation tools designed to advance cybersecurity improvement efforts, specially tailored for small and medium-sized organizations (SMO), but also for public institutions.

Managing and analyzing data in data lakes for big data environments requires robust protocols to ensure security, scalability, and compliance with privacy regulations. The increasing need to process sensitive data emphasizes the relevance of secure-by-design approaches that integrate encryption techniques and governance frameworks to protect personal and confidential information. This study proposes a protocol that combines the capabilities of Databricks and format-preserving encryption to improve data security and accessibility in data lakes without compromising usability or structure. The protocol was developed using a design science methodology, incorporating findings from a systematic literature review and validated through expert feedback and proof-of-concept experiments in banking environments. The proposed solution integrates multiple layers, data ingestion, persistence, access, and consumption, leveraging the processing capabilities of Databricks and format-preserving encryption to enable secure data management and governance. Validation results indicate the protocol is effectiveness in protecting sensitive data, with promising applicability in regulated industries. This work contributes to addressing key challenges in big data security and lays the groundwork for future developments in data governance and encryption techniques.

Context: Managing and analyzing data in Data Lakes for Big Data environments requires robust protocols to ensure security, scalability, and compliance with privacy regulations. The rapid growth of sensitive data processing highlights the importance of secure-by-design approaches that integrate encryption techniques and governance frameworks to safeguard personal and sensitive information. Aim: This study aims to design and validate a protocol that combines Databricks and Format-Preserving Encryption (FPE) to enhance data security and accessibility in Data Lakes, ensuring data privacy without compromising usability or structure. Method: The study uses Design Science a the main methodology, where a systematic literature review was conducted to identify existing encryption techniques and challenges in data governance. The proposed protocol was developed using a secure-by-design framework, validated through expert feedback, and tested using proof-of-concept experiments in banking environments. Results: The protocol features multiple layers—data ingestion, persistence, access, and consumption—that integrate Databricks’ advanced processing capabilities with FPE. It enables secure data ingestion, controlled access, and efficient governance while maintaining data usability. The validation demonstrated its effectiveness in safeguarding sensitive data, with potential for broader application in regulated industries. Conclusions: This work addresses critical gaps in Big Data security and proposes a scalable, secure framework for Data Lake management. It sets the foundation for future advancements in data governance and encryption methodologies across diverse domains.

This paper introduces a secure sum protocol using the Damgrd-Jurik cryptosystem, implemented and evaluated within an experimental setup that considers both vertical and horizontal partitioning. The proposed protocol offers significant improvements in privacy and efficiency due to its homomorphic properties and the conceptual enhancement of the protocol, where only a single piece of data needs to be encrypted per party, since the sum of each party’s data is performed locally. Furthermore, the practical feasibility of this protocol is reinforced by the proof-of-concept and performance evaluation, demonstrating its effectiveness and efficiency in handling large datasets. The findings underscore the protocol’s ability to maintain data privacy through encryption and ensure result integrity via Non-Interactive Zero-Knowledge Proofs (NIZK). The results and evaluations presented herein support its potential practical applicability.

We introduce an innovative approach for secure communication in the Internet of Things (IoT) environment using a one-time pad (OTP) protocol. This protocol is augmented by incorporating a secure multiparty sum protocol to produce OTP keys from genuine random numbers obtained from the physical phenomena observed in each device. We have implemented our method using ZeroC-Ice v.3.7, dependable middleware for distributed computing, demonstrating its practicality in various hybrid IoT scenarios, particularly in devices with limited processing capabilities. The security features of our protocol are evaluated under the Dolev–Yao threat model, providing a thorough assessment of its defense against potential cyber threats.

The process of establishing secure communication between devices in the Internet of Things (IoT) can be approached by using a One-time-Pad (OTP) protocol. We propose using a known secure multiparty sum protocol for generating a One-time-Pad key using true (physical) random numbers in each device (party). We implemented the proposal using ZeroC-Ice, a middleware for distributed computing. The protocol security properties were analyzed under the assumptions of the Dolev-Yao threat model.

In today’s world, private and government organizations are legally obligated to prioritize their information security. They need to provide proof that they are continually improving their cybersecurity compliance. One approach that can help organizations achieve this goal is implementing information security maturity models. These models provide a structured framework for measuring performance and implementing best practices. However, choosing a suitable model can be challenging, requiring cultural, process, and work practice changes. Implementing multiple models can be overwhelming, if possible. This article proposes a prioritization strategy for public institutions that want to improve their information security maturity. We thoroughly analyzed various sources through systematic mapping to identify critical similarities in information security maturity models. Our research led us to create the AIM (Awareness, Infrastructure, and Management) Triad. This triad is a practical guide for organizations to achieve maturity in information security practices.

While some areas of software engineering knowledge present great advances with respect to the automation of processes, tools, and practices, areas such as software maintenance have scarcely been addressed by either industry or academia, thus delegating the solution of technical tasks or human capital to manual or semiautomatic forms. In this context, machine learning (ML) techniques play an important role when it comes to improving maintenance processes and automation practices that can accelerate delegated but highly critical stages when the software launches. The aim of this article is to gain a global understanding of the state of ML-based software maintenance by using the compilation, classification, and analysis of a set of studies related to the topic. The study was conducted by applying a systematic mapping study protocol, which was characterized by the use of a set of stages that strengthen its replicability. The review identified a total of 3776 research articles that were subjected to four filtering stages, ultimately selecting 81 articles that were analyzed thematically. The results reveal an abundance of proposals that use neural networks applied to preventive maintenance and case studies that incorporate ML in subjects of maintenance management and management of the people who carry out these tasks. In the same way, a significant number of studies lack the minimum characteristics of replicability.