Integrated adaptive system of security risk assessment for information systems resources

Abstract

The basis of the information security management systems is the procedure of risk management, which includes the processes of analysis and assessment. Nowadays, there is a number of different techniques of risk assessment. They are usually based on the use of statistical data on incidents, related to security violation of information systems resources. The process of collecting such data is not always organized at the enterprises. There is a need for integrated tools that would enable to carry out risk assessment in automatic mode and implement an assessment both in determined and in fuzzy, weakly formalized environment. In this regard, based on the model of the synthesis of the security risk assessment systems of information systems resources, integrated method, as well as the increment and decrement methods of linguistic variable it was proposed the structural solution of integrated adaptive system of analysis and risk assessment. On its basis the algorithm and software that, unlike known, uses as input the various sets of estimated parameters as entrance data that provides high flexibility and convenience of use both in determined, and in fuzzy, weakly formalized environment are developed.