An approach to evaluating the effectiveness of the information security system for a distributed data transmission system

Bezopasnostʹ Informacionnyh Tehnologij

Grigory P. Gavdan¹  Sergey A. Reznichenko²  Oleg G. Evdokimov³ 

[1] National Research Nuclear University MEPhI (Moscow Engineering Physics Institute);National Research Nuclear University MEPhI (Moscow Engineering Physics Institute);The Department of the FSTEC of Russia for the Central Federal District;

关键词: information security, object of critical information infrastructure, data transmission, distributed system, information security system.;   

DOI  :  10.26583/bit.2022.2.05

来源: DOAJ

【 摘 要 】

The purpose of the paper is to identify possible approaches to assessing the effectiveness of the information security system (EISS) for a distributed data transmission system (DDTS) related to a significant object of critical information infrastructure. When developing the EISS, it is necessary to identify possible external and internal sources of threats to information security already at the design stage of the DDTS architecture as well as to develop a model of the violator and a model of information security threats (IS). One of the main problems in the creation of EISS DDTS is the lack and/or insufficient training in the field of information security; a large financial burden on the creation and modernization of hardware and software, etc. The DDTS model (a block diagram of the DDTS and the layout of the components of the DDTS on special computing equipment) is proposed for the EISS DDTS under study. The paper proposes an approach to assessing the effectiveness of the EISS DDTS based on the use of the method of expert assessments for the selected model, which is necessary to achieve the required level of safety. The aspects of assessing the effectiveness of the EISS DDTS are considered using the example of the organization of technical measures to ensure the IB DDTS. This assessment of the effectiveness of the EISS DDTS allows you to identify weaknesses and help you quickly take measures to eliminate them, which in the event of computer attacks or incidents can significantly reduce the risks. The proposed approach can be integrated into existing practices for assessing the effectiveness of information security.

【 授权许可】

Unknown