SERPRO

• case

GOVERNMENTAL REVOLUTION

Serpro combines Risk Analysis with Modulo Risk Manager to provide governmental institutions with better services

SERPRO - Serviço Federal de Processamento de Dados (Federal Service of Data Processing) is the main reference for Information Technology in the Brazilian Government. Serpro was created in 1964, and it is responsible for IT management in many institutions of the three governmental sectors. Its responsibilities include application development, based on open source software, portals creation, security strategies definition, and tooling selection in order to optimize the expertise management of those entities.

Furthermore, the institution is leading the Electronic Government project, also known as e-Gov, which aims to create the necessary conditions for digital public services, including digital inclusion initiatives and Internet access. Besides the integration of various systems and different suppliers' data bases, which are spread allover the Government sectors.

Interoperability is the key word of e-Gov, which aims to avoid the trap Information Technology has become: heterogeneous, complex, and incommunicable environments. This scenario instead of increasing reliability and data process speed, represents one more obstacle for society's communication and access. If supporting all this structure is already a great challenge, creating the foundation for e-Gov in an interoperable environment among various sectors is even a greater one.

“The concept that IT can define the way for a new Government image is rising. This movement aims to facilitate the citizens' lives and Serpro has to continue leading it”, states Gilberto Netto, Security process coordinator for the Institution. In his opinion, the project aims to invert the already established relation between Informatics and the State. “Historically, IT was implemented in order to facilitate Government's life. The moment for amplifying its relationship has come. Technology needs to make citizens' lives easier", he adds.

Both for e-Gov project consolidation and for Serpro's operation the definition of an Information Security Strategy partner was essential. “In order to choose this partner, we have defined Business Continuity as a requirement, Employees Training and Consciousness, besides from Risk Analysis. We chose Modulo to help us on defining Sepro's security definitions”, states Gilberto Netto. For him, it was important contract a company with such experience and tools, in order to simplify the process of an almost intrinsic level protection.

The partnership was created to improve security management inside Serpro. In general, Gilberto Netto adds, Modulo helped on the elaboration of a Information Security Policies and a Business Continuity Plan and their implementation, in addition to Risks Analysis in Critical Mission environments. The benefits achieved include capability to identify and correct vulnerabilities, standardize Security evaluation process, guarantee management and technical reports on risks issuance, and automate and standardize information collection.

“The same way we have a development software standard with CMMI, we aim to have a strong operation in Information Security, in order to guarantee our processes and to provide greater reliability to the Institution as a whole”, states Gilberto. Those efforts contributes to the institution to be the first company of Public Administration in the South America to obtain the BS 7799 certificate. For him, the technology represents and will represent even more an essential punctilio on the e-Gov movement.

“Now the focus is on facilitating citizens’ lives. In addition to services which assure citizens to comply with their obligations, such as income taxes and other attributes; IT will offer services that assure their rights”, he believes. Thinking about the future, Gilberto Netto believes that classical problems such as INSS' - Instituto Nacional de Seguridade Social (National Institute of Social Security) endless lines or difficulties of scheduling medical appointments through the Sistema Unico de Saúde - SUS (Governmental Health Care System) can be facilitated by using technology.