QUANTITATIVE ASSESSMENT OF SECURE OPERATION OF INFORMATION SYSTEMS

Abstract

The basis of information security is the activity of protecting information — ensuring its confidentiality, availability and integrity, as well as preventing any compromise in a critical situation. Its correct provision is responsible for the security of the company's information infrastructure, the security of all its data and their confidentiality.

Currently, information security is in trend, however, it is always necessary to remember that it is not a set of expensive technical means, but a continuous process that must be constantly improved, responding to the emergence of new threats and attack techniques. The damage from these threats can significantly exceed the cost of implementing protective measures, and it is clear that these risks must be mitigated as effectively as possible.

The article developed a model for quantitatively assessing the coefficient of readiness for safe operation of information systems. To do this, the following was done:

• modeling the coefficient of readiness for safe operation, taking into account the impact of the simultaneous appearance in the system of several vulnerabilities of the same type;
• modeling the coefficient of readiness for safe operation, taking into account the probability of the presence of r unremedied vulnerabilities (real threats of vulnerabilities) in the system at the same time;
• modeling the readiness factor for the safe operation of a set of computers, for example, computer networks, where several vulnerabilities can be eliminated at the same time;
• modeling factor of readiness for safe operation if the protection system used for vulnerability leveling is ready for safe operation.

For graphical interpretation of dependencies, graphic materials are presented, for which simulations were performed in the MatLab system. The graphic materials clearly indicate the possibility of obtaining a state of safe operation of information systems depending on the intensity of stopping attempts by the protection system of illegal access to information, and the intensity of such attempts at the entrance to the protection system.

This will allow developers of information systems and service personnel to have quantitative indicators of the coefficient of readiness for safe operation of the system and decision-making regarding possible vulnerabilities.