Risk analysis and assessment of information resources
DOI:
https://doi.org/10.18372/2410-7840.15.4216Keywords:
risk, risk analysis, risk assessment, information security risk analysis and assessment method, risk management, risk parametersAbstract
The construction of information security management system (ISMS), complex system of information security and other security systems require carrying out the analysis and security risk assessment. The existing assessment tools in its majority are based on statistical approaches. In many countries, both at the enterprise level and at the State level such statistics is not conducted. This limits the ability of existing tools, such as the use of different input data types for assessment. A known tool gives no the administration opportunity for risks analysis and risk assessment of a wide range of initial parameters. On t he basis of the proposed risk analysis and assessment method, which based on the use of the integrated model representation of the risk parameters allow to conduct an assessment in the deterministic and fuzzy conditions using ten parameters, which can be represented as numeric and linguistic form, it was implemented the software system of risk analysis and assessment of information resources losses. To verify the developed software product there were designed various situations connected with the information security resources. The received results confirm the adequacy of software response on value changes of estimated component under different environment conditions, while the risk value does not change significantly when the basis of estimated components is changed.
References
Корченко А.Г. Интегрированное представление параметров риска / Корченко А.Г., Иванченко Е.В., Казмирчук С.В. // Защита информации – 2011. – №1 (50). – С. 96 – 101.
Корченко А.Г. Методология синтеза систем анализа и оценки риска потерь информационных ресурсов / Корченко А.Г., Казмирчук С.В. // Защита информации – 2012. – №2. – С. 24-28.
Корченко А.Г. Методы анализа и оценки рисков потерь государственных информационных ресурсов / Корченко А.Г., Щербина В.П., Казмирчук С.В. // Защита информации – 2012. – №1. – С. 126-139.
Корченко А.Г. Системы анализа и оценки риска потерь государственных информационных ресурсов / Корченко А.Г., Волянская В.В., Казмирчук С.В., Охрименко А.А. // Защита информации – 2012. – №2. – С. 52-58.
Луцкий М.Г. Исследование программных средств анализа и оценки риска информационной безопасности / Луцкий М.Г., Корченко А.Г., Иванченко Е.В., Казмирчук С.В. // Защита информации – 2011. – №3. – С. 97-108.
Луцкий М.Г. Современные средства управления информационными рисками / Луцкий М.Г., Иванченко Е.В., Корченко А.Г., Казмирчук С.В., Охрименко А.А. // Защита информации – 2012. – №1. – С. 5-16.
НД ТЗІ 1.4-001-2000 Типове положення про службу захисту інформації в автоматизованій системі. Затверджено наказом ДСТСЗІ СБ України від 04 грудня 2000 р. № 53.
ISO/IEC 27002:2005 Информационные технологии. Свод правил по управлению защитой информации c учетом Технической поправки 1, опубликованной 2007-07-01.
Korchenko A.G. Integrated view of risk characteristic / Korchenko A.G., Ivanchenko Ye.V., Kazmirchuk S.V. // Zahist ìnformacìï, 2011, №1 (50), pp. 96 – 101.
Korchenko A.G. The synthesis methodology of analysis systems and risk assessment of information resources losses / Korchenko A.G., Kazmirchuk S.V. // Zahist ìnformacìï , 2012, №2, pp. 24 – 28.
Korchenko A.G. Risk analysis and assessment methods of government information resources losses / Korchenko A.G., Sherbina V.P., Kazmirchuk S.V. // Zahist ìnformacìï, 2012, №1, pp. 126-139.
Korchenko A.G. Systems analysis and risk assess-ment of Government Information Resources losses / Korchenko A.G., Volyanskaya V.V., Kazmirchuk S.V., Okhrimenko A.A. // Zahist ìnformacìï, 2012, №2, pp. 52-58.
Lutskiy M.G. Research of information security risk & analysis assessment software / Lutskiy M.G., Korchenko A.G., Ivanchenko Ye.V., Kazmirchuk S.V. // Zahist ìnformacìï, 2011, №3, pp. 97-108.
Lutskiy M.G. Modern techniques of Information Risk Management / Lutskiy M.G., Ivanchenko E.V., Korchenko A.G., Kazmirchuk S.V., Okhrimenko A.A. // Zahist ìnformacìï , 2011, №1, pp. 5-16.
ND TZÍ 1.4-001-2000 Typical regulations on data protection agencies in the automated system.
ISO/IEC 27002:2005 Information technology – Security techniques – Code of practice for information security management.
Downloads
Published
Issue
Section
License
Authors who publish with this journal agree to the following terms:- Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).
