ADAPTIVE APPROACH TO CONSTRUCTION AND ENSURING THE FUNCTIONING OF INFORMATION SECURITY SYSTEMS - Arkhypov, Olexander; Arkhypov, Olexander (Ukrainian Information Security Research Journal, 2021)
The application of an adaptive approach to the construction and operation of an effective information security system (ISS) created by an organization-owner of an information resource in an “attack / defense” conflict situation arising when the attacker implements threats against the protected resource is considered. The content of the basic concepts of adaptive management of the information security system at various stages of information technology development is analyzed, in particular, the provision of adequate transformations of the defense paradigm caused by changes in the strategy and tactics of the attacker's actions. The features and possibilities of practical application of new concepts of protection are investigated, for example, assuming the insolvency of the requirement to take measures to prevent a possible dangerous incident in the event of unjustified high cost of their implementation in comparison with the assessment of the risk of losses as a result of the implementation of the incident. The application of an approach is proposed, the essence of which is to use information about the characteristics and nature of the behavior of both parties to the conflict in the creation and management of information security systems. Generalization and "packing" of the specified information is realized in the form of mathematical models - reflexive risks, the structure and set of which are determined by the selected typical scenarios for the development of the "attack / defense" situation. Analysis and research of models provides evaluative information that allows to ensure effective and rational investment in the organization's information security system, balancing the financial and economic capabilities of the organization with its requirements and capabilities in the field of information protection.