Method of information security management system structure synthesizing

Abstract

The requirements, expectations, and related restrictions of interested parties are considered as input data for the specification of requirements for information security management systems. They are complemented with the establishment of internal and external factors that influence or can influence the activity of the organizations. According to the requirements specification, many interrelated functions with internal and external interfaces are defined. Each of them is decomposed according to the structural elements of information security management systems into the functions of subsystems, complexes, components. This shows the insufficiency of the definition of structural elements and their inherent functions. This is limited by the need to clarify the essence of information security management systems, taking into account the needs, goals, processes, structure of organizations. Therefore, they are considered as a set of subsystems, complexes, components, and relations between them. In general, this combination forms the structure of information security management systems. To represent it, diagrams in SysML graphic notation are used. Behind it, structural elements are reflected in blocks as modular units. Therefore, information security management systems are represented by a tree of modular units. Characteristics for them are determined by properties, among the properties stand out special classes - ports and restrictions. Their use allows to focus on the limitations and features of the interaction of blocks with each other. While the features of such interaction are taken into account by the types of relations. Therefore, by synthesizing the structure of information security management systems, its structural elements (subsystems, complexes, components) and the relationship between them are determined. Due to this, it is possible to set the properties of these systems regarding specific options for developing and demonstrating possible directions for achieving the goal. In particular, confidentiality, integrity and availability of information in organizations through risk assessment. This ensures that information security management systems achieve the planned implementation results. First of all, providing confidence to stakeholders to properly manage risks at an acceptable level.