Method of information security management systems behavior synthesizing

Abstract

The behavior of information security management systems is determined due to activities to keep the confidentiality, integrity, and availability of information in organizations. It is characterized by a sequence of risk management actions on the part of structural elements. The prerequisites for such activities have been established. Among them, definitions of external and internal factors of organizations’ activities, needs, and expectations of stakeholders, scope and limits of information security management systems application, the establishment of acceptability criteria, and selection of risk assessment methods are highlighted. Taking this into account, it was proposed to synthesize the behavior of information security management systems in three aspects. To do this, the activity, sequence, and state machine diagrams in SysML graphic notation are used. Each of the above diagrams synthesized its features as individual structural elements, and information security management systems in general. Activity diagrams specify behavior through a controlled sequence of actions. The characteristic feature of this specification is the orientation towards the establishment of conditions for their implementation. At the same time, represent objects as inputs and outputs of each action. Time features of transmission and reception of objects between structural elements of information security management systems are reflected in the sequence diagram through their interactions. The basis of such interaction is to establish a sequence of message exchange. It is possible either between information security management systems and their environment or between structural elements at any hierarchy level. In this case, both structural elements and information security management systems are interpreted by individual entities – lifelines. The interaction between them is represented by the exchange of messages. The change in states when certain conditions occur is reflected in the state machine diagram. Its use is aimed at describing the behavior according to the “state–transition” scheme. This is accompanied by the creation and destruction of objects, change of their attribute values, generation of messages between them. Therefore, the behavior is represented by the sequential passage of the vertices of a finite automaton graph by directed arcs. Due to this, the activity features of information security management systems in organizations by synthesizing their behavior were established.