A geometric approach to the acceptable risk probabilities estimation of information security

Authors

  • Владимир Владимирович Мохор Pukhov Institute for Modelling in Energy Engineering of National Academy of Sciences of Ukraine
  • Александр Олегович Бакалинский National technical university of Ukraine «Kyiv polytechnic institute»
  • Василий Васильевич Цуркан National technical university of Ukraine «Kyiv polytechnic institute»

DOI:

https://doi.org/10.18372/2410-7840.18.10850

Keywords:

geometric probability, geometric approach, information security risk, acceptable risk, probability estimation, risk-appetite, risk owner, information security risk management system

Abstract

Construction and usage of the information security management system based on a risk-oriented approach is considered. At the same time nonconstructivity of project requirements for the construction of such sys-tems by «ensuring the level of risk no higher than acceptable» is defined. In order to overcome this limit proposed to review the functioning of an information security management system as a queuing system with processing the flow of risk events with levels of risk that higher than acceptable and a defined probability of such events occurrence. The solution to this problem is realized by the use of concepts and methods of geometrical probability. With this approach the subjective indicator of risk owner risk-appetite, displayed in the form of acceptable level of risk is transformed into a formalized probabilistic criterion, on which is possible to formulate verifiable requirements for the establishment of information security management systems

Author Biographies

Владимир Владимирович Мохор, Pukhov Institute for Modelling in Energy Engineering of National Academy of Sciences of Ukraine

doctor of engineering science, professor, Director of Pukhov Institute for Modelling in Energy Engineering of National Academy of Sciences of Ukraine

Александр Олегович Бакалинский, National technical university of Ukraine «Kyiv polytechnic institute»

deputy head of department, State institution «Institute of special communications and information security National technical university of Ukraine «Kyiv polytechnic institute»

Василий Васильевич Цуркан, National technical university of Ukraine «Kyiv polytechnic institute»

candidate of engineering science, leading researcher of State institution «Institute of special communications and information security National technical university of Ukraine «Kyiv polytechnic institute».

References

Компания «Инфосистемы Джет» построила СУИБ «Эльдорадо» [Электронный ресурс]. – Режим доступа : http://www.osp.ru/osp-new/ public/resources/releases/?rid=7954. – Дата до-ступа : июнь 2016. – Название с экрана.

ISO 27001 – Information Management Security System [Electronic resource]. – Access mode : http://www.enhancequality.com/iso-standards/ iso-27001-information-security-management-sys-tem/. – Access data : June 2016. – The title of the screen.

Дмитриев А. Менеджмент информационной безопасности [Электронный ресурс] / А. Дмитриев. – Режим доступа : http://www.comizdat. com/index_.php?in=ksks_articles_id&id=568. – Дата доступа : июнь 2016. – Название с экрана.

Information technology. Security techniques. Information security management systems. Require-ments : ISO/IEC 27001:2013. – Second edition 2013-10-01. – Geneva, 2013. – P. 23.

Information technology. Security techniques. Information security risk management : ISO/IEC 27005:2011. – Second edition 2011-06-10. – Ge-neva, 2011. – P. 68.

Методичні рекомендації щодо впровадження системи управління інформаційною безпекою та методики оцінки ризиків відповідно до стандартів Національного банку України [Електронний ресурс]. – Режим доступу : http://zakon3.rada.gov.ua/laws/show/v0365500-11/page. – Дата доступу : червень 2016. – Назва з екрану.

Information technology. Security techniques. Information security incident management : ISO/IEC 27035:2011. – First edition 2011-09-01. – Geneva, 2011. – P. 78.

Кендалл М. Геометрические вероятности / М. Кендалл, П. Моран. – М. : Наука, 1972. – 192 с.

Downloads

Published

2016-09-26

How to Cite

Мохор, В. В., Бакалинский, А. О., & Цуркан, В. В. (2016). A geometric approach to the acceptable risk probabilities estimation of information security. Ukrainian Information Security Research Journal, 18(3), 210–217. https://doi.org/10.18372/2410-7840.18.10850

Issue

Vol. 18 No. 3 (2016)

Section

Articles

License

The scientific journal adheres to the principles of Open Access and provides free, immediate, and permanent access to all published materials without financial, technical, or legal barriers for readers.

All articles are published in Open Access under the Creative Commons Attribution 4.0 International (CC BY 4.0) license.

Copyright

Authors who publish their works in the journal:

  • retain the copyright to their publications;

  • grant the journal the right of first publication of the article;

  • agree to the distribution of their materials under the CC BY 4.0 license;

  • have the right to reuse, archive, and distribute their works (including in institutional and subject repositories), provided that proper reference is made to the original publication in the journal.